Archive through 2026-09-303115 cards in this category
Category home · 15
Pages with credibility, finance, impersonation, or trust concerns that reward careful reading.
Visual leads · 2026-09-30
Observed 2026-09-30
The eChallan APK detour
echalla.boats
A page styled as India’s eChallan traffic-enforcement portal directs visitors toward an 18 MB Android app download.
Observed 2026-09-30
The eChallan APK detour
echalla.homes
A page posing as India’s government eChallan portal prompts visitors to install an 18 MB verification app on Android.
Observed 2026-09-30
The eChallan APK prompt on echalla.lat
echalla.lat
The page presents itself as an Indian government eChallan portal, then says a vehicle has been flagged for internal review and directs visitors to download an Android app.
Observed 2026-09-30
The .club “WebTapu” payment flow
pratigimhizlidir.club
A page on a .club domain presents itself as Turkey’s land-registry appointment service and guides visitors toward a paid “pre-appointment.”
Observed 2026-09-30
A purported court document, then an account-takeover scare
fs-sp.top
The page impersonates Russian government services and asks visitors for a phone number, SMS code, and name to access a purported PDF.
Observed 2026-09-30
The fake MetaMask security alert
metamask.one
A MetaMask-impersonating page uses an unfamiliar-device warning to solicit a wallet recovery phrase, exchange details, and contact information.
Observed 2026-09-30
StillEgg’s increasingly expensive mystery
stillegg.com
An interactive egg mystery pairs fictional specimen readings with a real $STILLEGG token-burning counter.
Observed 2026-09-30
RustDesk’s remote-access page on rasdeskc.com
rasdeskc.com
A RustDesk-branded page presents remote desktop software, self-hosting instructions, and links to product resources.
Complete daily shelf · Suspicious Gentlemen
The eight visual leads appear above; the remaining 7 continue here in their published shelf order.
São Silvestre 2026, with a placeholder CNPJ
corridasaosilvestre.com
A registration page offering kits and PIX payment for the 101st São Silvestre race, while stating it is not the official site.
The Airbnb deposit page on a numeric .shop domain
73159.shop
A Slovenian-language page presents a purported Airbnb long-term-rental deposit process and asks the landlord to enter bank details for a €500 payout.
A São Silvestre 2026 checkout with unfinished legal fields
saosilvestrecorrida.com
The page presents registration for the 2026 São Silvestre race, with kit options, runner details, and a PIX payment flow.
A TotalEnergies-branded pitch for AI crypto trading
totalenergies-ia.com
The French-language page advertises automated trading in stocks and cryptocurrencies, with a stated minimum investment of €250.
Bifrost Wallet’s “Rectification” Doorway
bifrostdefi.com
The page presents a multi-chain crypto wallet alongside support links that invite visitors to connect a wallet to resolve account and token issues.
Monte Argento’s shelter page, with a slot-machine hitch
monteargento.org
An animal-shelter association in Terni presents dog adoption, donations, volunteering, and membership information.
A password-gated AI plan for Raintree Systems
raintree-ai.com
The site presents a purported 2027 operating plan mapping eighteen AI agents to Raintree Systems’ goals, with modeled returns and working prototypes.
Across the archive
3,115 cards provide an early longitudinal view—not a measure of the whole web.
The rolling 21-day upper threads compare daily category medians; the bold thread is Suspicious Gentlemen. Below, signal colour shows the share of that day’s published Suspicious Gentlemen cards carrying each mark.
This exposes association inside the published catalogue, not causation or site quality. The 80+ threshold is the pipeline’s editorial-interest score.