Archive through 2026-10-143389 cards in this category
Category home · 15
Pages with credibility, finance, impersonation, or trust concerns that reward careful reading.
Visual leads · 2026-10-14
Observed 2026-10-14
OneKey’s “security update” asks for the keys to your wallet
onekeysecure.online
The page presents itself as a OneKey hardware-wallet firmware update, then asks visitors to enter a recovery phrase or private key.
Observed 2026-10-14
An airline-help page asks for bank logins and OTPs
penerbanganmaskapaii.com
A page presenting itself as Indonesian flight support offers booking help, then displays forms requesting online-banking credentials, SMS OTPs, and card details.
Observed 2026-10-14
A purported UnionPay policy on a refund domain
epayrefund.com
epayrefund.com displays UnionPay-branded navigation and a Chinese-language lookup page for a purported payment-account insurance policy.
Observed 2026-10-14
BAFZ-2043: a personnel form on aoipms.online
aoipms.online
A detailed personnel-record form says it stores entries on the user’s device, then instructs users to download and email the completed files.
Observed 2026-10-14
A purported bank NID portal asks for MoBanking passwords
globalnidupdate.com
The page presents a three-step identity-verification form under Global IME Bank’s name, requesting banking credentials and family details.
Observed 2026-10-14
A $2,800 Walmart reward with a release fee
walmartaccess.site
A Walmart-branded payout page on walmartaccess.site claims shoppers can withdraw thousands of dollars after paying a supposedly refundable fee.
Observed 2026-10-14
A Pi Wallet “2FA” Page Asking for the Recovery Phrase
pinetkyc.site
The page claims to activate email-based two-factor authentication for Pi wallets, but its flow asks visitors for a 24-word passphrase and an email verification code.
Observed 2026-10-14
An Orange login on orangereset.help
orangereset.help
The page presents an Orange-branded account login and a one-time-code verification prompt on orangereset.help.
Complete daily shelf · Suspicious Gentlemen
The eight visual leads appear above; the remaining 14 continue here in their published shelf order.
A Rothschild & Co homepage on trustpo.site
trustpo.site
The page presents Rothschild & Co’s financial-services businesses, news and insights, alongside a sign-in option.
Ashgrove Data’s company-data valuation calculator
ashgrovedata.com
Ashgrove Data estimates what a company’s internal records might be worth to AI data buyers and invites companies to request a firm valuation.
The “Official” Bitmain Shop with a Disclaimer
xn--bitmai-1eb.com
A storefront lists Antminer mining hardware, hosting equipment, and accessories with product specifications and prices.
A Ledger Nano X storefront on 6da9k.com
6da9k.com
A product page presenting a Ledger Nano X hardware wallet for $49.50, with reviews, product claims, and shopping-cart prompts.
A memorial page with a Solana token attached
forwalterjr.org
The site presents itself as an independent tribute to RJ Mitte, with suicide-prevention resources, direct charity links, and a linked Solana token called $WALTJR.
The Pharmacy Promotion on a University Homepage
indigetrx.shop
On indigetrx.shop, a pharmacy promotion appears alongside a substantial Touro University Worldwide homepage.
A Trezor-branded domain, a Miami currency-exchange page
integration-trezor.com
integration-trezor.com resolves to a locations page for Miami Money Exchange, listing branches in Downtown Miami, Doral, and Hialeah.
A sanctions search on an extra-s domain
sanctionssearchs.org
A search interface for sanctions lists, with filters and approximate name matching.
Terry’s Custom Seats meets 真龙国际
terryscustomseats.com
The homepage pairs Chinese gambling-platform branding in its metadata with a steel-structure manufacturer’s company profile, product listings, and project cases.
xThreat.rip’s malware workbench, with a credibility question
xthreat.rip
xThreat.rip presents a gated malware-analysis workbench that says it combines static unpacking, sandbox reports, and IOC lookups.
ExamLab’s JEE feedback form asks for candidate identifiers
examlabfeedback.cyou
A five-step JEE exam-centre feedback form that asks respondents to identify themselves and optionally upload an admit card.
academiaarin-jp.com → Japan’s e-Tax portal
academiaarin-jp.com
The observed destination is Japan’s national tax electronic filing and payment portal, despite the unrelated academic-sounding domain.
Aznsec.com lands on the FBI homepage
aznsec.com
The observed domain redirects to the FBI’s official homepage, with no visible explanation connecting the two.
A page titled “Trust Wallet” presents a wallet-import flow that asks visitors for an email address and a Secret Recovery Phrase or Private Key.
Across the archive
3,389 cards provide an early longitudinal view—not a measure of the whole web.
The rolling 21-day upper threads compare daily category medians; the bold thread is Suspicious Gentlemen. Below, signal colour shows the share of that day’s published Suspicious Gentlemen cards carrying each mark.
This exposes association inside the published catalogue, not causation or site quality. The 80+ threshold is the pipeline’s editorial-interest score.