Archive through 2026-10-033159 cards in this category
Category home · 15
Pages with credibility, finance, impersonation, or trust concerns that reward careful reading.
Visual leads · 2026-10-03
Observed 2026-10-03
The eChallan page that asks Android to sideload an APK
fwieahfgroup.top
It presents itself as India’s eChallan service, but pairs a vehicle-verification prompt with instructions to sideload an Android app.
Observed 2026-10-03
A Warner Music Group-branded copyright appeal portal
dmcawarnergroup.com
The site presents a YouTube channel lookup and appeal flow for alleged Warner Music Group copyright claims.
Observed 2026-10-03
A Treasury-branded “Joint Asset Portfolio”
ustreasurydept.org
The page presents a supposed $2.44 million portfolio, participant records, and a ten-stage asset-transfer history awaiting beneficiary verification.
Observed 2026-10-03
Rat Brain’s stock-token maze
ratbrain.net
RATBRAIN presents a daily maze game that says recorded rat-neuron activity steers the controls, with play rewards tied to its $RAT token and stock-token swaps.
Observed 2026-10-03
The FACEIT Verification That Wants a Shell Command
face-it-anti-cheat-cdn.top
A FACEIT-branded page on face-it-anti-cheat-cdn.top tells visitors to paste a command into a computer’s system shell to prove they are human.
Observed 2026-10-03
BuscaX’s face-search demo
buscax.site
A Portuguese-language landing page invites visitors to upload a face photo and claims to search public profiles across social platforms.
Observed 2026-10-03
The Gmail prize that costs R$97 to collect
acessodigital.world
A Portuguese-language page says visitors won R$17,658 through “Gmail Premia” and asks them to pay R$97 before a PIX transfer.
Observed 2026-10-03
A G1-branded betting-refund story asks for your CPF
estornobetsbrasil.online
The page claims Brazil is refunding money held in online betting accounts and offers a CPF check to see whether a visitor can claim it.
Complete daily shelf · Suspicious Gentlemen
The eight visual leads appear above; the remaining 12 continue here in their published shelf order.
A New Zealand department homepage on a .xyz address
dia-govt.xyz
The page presents itself as New Zealand’s Department of Internal Affairs, listing public services, reports and government updates.
A fake Госуслуги security alert
mo-svosogaz.info
A Russian-language page mimics a Госуслуги account, displaying alarming claims about biometric checks and personal documents.
Swabi Arms Licence Branch, on an Unofficial .xyz
swabiarmslicence.xyz
The site presents arms-licence record verification, branch enquiries, and a step-by-step guide to applying through Khyber Pakhtunkhwa’s DASTAK service.
A hotel domain wearing Samsung’s storefront, with togel links in the seams
hotelsantabarbaraplaza.com
The page combines Samsung Indonesia shopping content with Indonesian online-togel links and a PTTOGEL guide title.
A Music Domain, a Sports Login, and a Machine-Shop Catalog
modhausemusic.com
A music-named domain displays Chinese sports-login branding alongside a catalog and company profile for a Wuxi machinery supplier.
The iolo Support Page With Two Phone Numbers
us-iolo.support
A standalone page presents itself as a support contact point for iolo software, with chat and phone help.
An Artek homepage on an unrelated-looking .shop domain
kravomqelux.shop
The page presents a polished Artek furniture homepage, but its domain does not appear related to the brand.
Ember Relay’s Telegram account-linking flow
ember-relay.com
A step-by-step setup page for connecting a Telegram account to Ember Relay, requesting Telegram API credentials, a phone number, a login code, and a two-step password.
Correio Express’s “retained parcel” notice
correioexpress.vip
A Portuguese-language page says a parcel is being held for verification and urges visitors to check its status.
Palhaço Mauro’s “Pra Uma Pessoa Só” Fundraiser
juntospelomauro.org
A Portuguese-language fundraiser offers pay-what-you-choose access to a recorded clown show, with proceeds said to support Mauro’s heart surgery.
Silicon.mu routes coding-model access through Instagram
siliconmu.xyz
The page offers a key for using Claude, GPT and Grok in several coding editors, with usage paid in Mauritian rupees.
The sports domain that lands on Debbie Schlussel’s blog
debbiedoessports.com
The sports-branded address resolves to an archive-style personal site for political and film commentary, with unrelated replica-watch and casino links in the extracted page.
Across the archive
3,159 cards provide an early longitudinal view—not a measure of the whole web.
The rolling 21-day upper threads compare daily category medians; the bold thread is Suspicious Gentlemen. Below, signal colour shows the share of that day’s published Suspicious Gentlemen cards carrying each mark.
This exposes association inside the published catalogue, not causation or site quality. The 80+ threshold is the pipeline’s editorial-interest score.