Scam intelligence, backed by evidence.
Evidence-based scam-awareness research from EverydaySecurity — definitions, comparisons, real evidence, and step-by-step guidance for the scams we investigate.
Adaptive Phishing Kits: Device- and Location-Aware Scams
Adaptive phishing kits inspect the visiting device, location, and time before deciding how to attack — the same link can steal a password on one device and install malware on another.
AI Vibe-Coding Tools Used to Build Scam Sites
Scammers are using consumer AI app-builders to stand up convincing brand-impersonation sites in hours instead of weeks, then pairing them with paid social ads to borrow the impersonated brand's trust.
Government & Business-Filing Impersonation Scams
Government-filing impersonation scams use a business's own public filing data — LLC registration numbers, trademark serial numbers — to send fake compliance notices that look official enough to pay.
How Scammers Hide Their Infrastructure
Scam infrastructure relies on the same anonymity and evasion techniques regardless of the scam on top of it — CDN-based anonymity and bot-detection evasion are two distinct hiding techniques worth recognizing separately.
Malware Distributed Through Fake Trading Platforms
Some fake trading-platform sites aren't after your deposit at all — the platform itself is the delivery mechanism for malware that steals banking credentials and government ID.
Phishing Pages Hosted on Free Website Builders
Some phishing kits don't need a server, a domain, or anywhere of their own to send stolen passwords — a free account on a consumer website builder can supply hosting, the fake login form, and the credential-delivery channel all at once.
Recruiting Scams: Compromised Accounts and the AI-Text Tell
Recruiting scams increasingly run through compromised legitimate recruiter accounts, and the follow-up messages often carry statistical tells of AI-generated text worth learning to spot.
Reverse-Proxy Exchange Phishing: A Technical Investigation
Reverse-proxy phishing kits don't clone an exchange's frontend — they transparently proxy the real one, intercepting only credentials while every other system, including the exchange's own fraud detection, runs exactly as it would for a legitimate session.
Verifying Before Reporting: Our Investigation Methodology
Not everything that looks like a scam is one. This page documents how we verify before we call something a scam — including a case where we retracted an earlier call, and a false-positive detection from the technical side.
Think you've spotted a scam?
Send it to us and we'll investigate it for free — the findings help build pages like this one.