Archive through 2026-11-103916 cards in this category
Category home · 15
Pages with credibility, finance, impersonation, or trust concerns that reward careful reading.
Visual leads · 2026-11-10
Observed 2026-11-10
A “Czech National Bank” page asking for a loan-approval transfer
cnb-uver.com
A Czech-language payment page branded with the Czech National Bank and Ministry of Finance names requests an instant bank transfer for “loan approval.”
Observed 2026-11-10
ShadowPass, the ad-review cloaker
shadowpassads.com
ShadowPass markets a tool that changes video, image, copy, and audio fingerprints so ad-review systems may treat a creative as a new file.
Observed 2026-11-10
Mercado Libre Capital, on a sunnybeam.live domain
sunnybeam.live
A Spanish-language landing page asks visitors to register for an investment account and deposit 150,000, with a stated monthly income objective of 3,500,000.
Observed 2026-11-10
A Spanish Social Security notice with a ZIP-shaped hook
regulacion-electrica.com
The page presents an urgent 2026 contribution update as a notice from Spain’s Social Security administration and offers a ZIP file of related documents.
Observed 2026-11-10
FBM Disbursement Desk’s Claimed $864.20 Balance
accounts4cash.dev
A page styled as an “FBM Disbursement Desk” claims an account in the visitor’s name holds $864.20 and offers an unlock for $19.
Observed 2026-11-10
HAKWAP’s seed-phrase request
hakwap.xin
HAKWAP presents a cross-chain cryptocurrency swap interface, with routes including ETH-to-BTC and XRP-to-USDC.
Observed 2026-11-10
An imToken APK page on an imtokean-apk domain
imtokean-apk.com
A Chinese-language page presents itself as an imToken wallet site, with an Android download prompt and extensive security and product claims.
Observed 2026-11-10
Coinbase Capital Markets, on a non-Coinbase domain
coinbasesus.com
An institutional page claiming to represent Coinbase Capital Markets Corporation, with company, regulatory, and brokerage information.
Complete daily shelf · Suspicious Gentlemen
The eight visual leads appear above; the remaining 13 continue here in their published shelf order.
HUTXJ’s biomedical dispatches
hutxj.com
A journal-style site presents six biomedical stories covering gene editing, cancer vaccines, diagnostics, epigenetics, biomanufacturing, and the microbiome.
Lex Virginia’s claimed court-filing command hub
lexvirginia.com
Lex Virginia presents itself as an official Virginia court e-filing, docket-search, and service-of-process platform.
A Signal setup flow on makesignal.online
makesignal.online
The page presents a step-by-step flow to register a Signal phone number, set a PIN and display name, and link Signal Desktop.
Meds UK Suppliers’ Prime Direct pharmacy storefront
medsuksuppliers.com
The site presents an online pharmacy storefront with priced medication listings and claims of UK delivery.
A medicine-verification page with a mismatched address
ziskapnhrma.com
The page presents a form for checking a pharmaceutical product with a 12-digit code from its packaging.
Skynet Client’s “tactical advantage” for DDNet
skynetclient.online
A page for a DDNet client advertising aim assistance, trajectory prediction, evasion, player radar, and chat translation.
TokenPocket on a lookalike domain
tokenpockavt.com
A Chinese-language page presents TokenPocket wallet products, download prompts, tools, and basic setup guidance.
A Dayton spiritual center under a lottery-keyword fog
climatereadyschools.org
The homepage presents Center for Spiritual Living Greater Dayton—services, classes, community stories, and spiritual beliefs—while Chinese-language Australian lottery copy intrudes throughout its metadata and headings.
A sports portal wearing Anna’s domain
laughwithanna.com
A Chinese-language AOA sports portal presents match coverage, app access, VIP benefits and payment channels on laughwithanna.com.
Marcel Digital’s homepage, with an unexpected prize pool
marcelmorelaipower.com
A B2B digital agency homepage presents Umbraco, web development, SEO, and paid-media services alongside incongruous prize-pool, agent, and salary-check-in links.
A storefront for allegedly cloned payment cards
eazypassshop.com
The homepage advertises cloned credit and debit cards for sale, with product listings and price ranges.
The Bitcoin-wallet alias that lands on Electrum.org
electrum-assets.org
electrum-assets.org redirects to Electrum’s Bitcoin wallet homepage at electrum.org.
ZONA81 on an interior-design domain
wonginterieurs.site
An Indonesian-language page presents ZONA81 as a premium digital-entertainment destination, alongside login controls and an extensive news-style navigation menu.
Across the archive
3,916 cards provide an early longitudinal view—not a measure of the whole web.
The rolling 21-day upper threads compare daily category medians; the bold thread is Suspicious Gentlemen. Below, signal colour shows the share of that day’s published Suspicious Gentlemen cards carrying each mark.
This exposes association inside the published catalogue, not causation or site quality. The 80+ threshold is the pipeline’s editorial-interest score.