1f:I[37893,["/_next/static/immutable/chunks/42wxwy2vcm6qu.js","/_next/static/immutable/chunks/22ily9ugk8_iw.js","/_next/static/immutable/chunks/42gqngr8h9p1c.js"],"ReportBrowser"] 1d:["$","dl",null,{"className":"mt-8 flex flex-wrap gap-x-10 gap-y-4","children":[["$","div",null,{"children":[["$","dt",null,{"className":"label-mono","children":"Published alerts"}],["$","dd",null,{"className":"figure mt-1 text-xl font-semibold ","children":"8"}]]}],["$","div",null,{"children":[["$","dt",null,{"className":"label-mono","children":"Reported exposure"}],["$","dd",null,{"className":"figure mt-1 text-xl font-semibold ","children":"$$456,000"}]]}],["$","div",null,{"children":[["$","dt",null,{"className":"label-mono","children":"Critical severity"}],["$","dd",null,{"className":"figure mt-1 text-xl font-semibold text-accent","children":"5"}]]}],["$","div",null,{"children":[["$","dt",null,{"className":"label-mono","children":"Reporting parties"}],["$","dd",null,{"className":"figure mt-1 text-xl font-semibold ","children":"50"}]]}],["$","div",null,{"children":[["$","dt",null,{"className":"label-mono","children":"Last change"}],["$","dd",null,{"className":"figure mt-1 text-xl font-semibold ","children":"2026-09-15"}]]}]]}] 20:T19db,

What was reported

A buyer reports losing $26,000 to Superior Equipment & Rental, a used heavy equipment seller publishing an address at 2231 Park St, Sheldon, IA 51201, on a 2017 Kubota SVL95-2s compact track loader advertised at superiorequipandrent.com/listing/2017-kubota-svl95-2s.

The seller would not hold or release the machine without the full amount by bank wire. The buyer sent it on August 11, 2026 and it settled the following day. What he asked for in writing and never received is the part of this account that can be checked by anyone: a photograph of the machine's PIN plate, the name of the carrier moving it, and a signed bill of sale. Calls to (712) 216-4264 and emails to sales@superiorequipandrent.com produced scheduling excuses for about two weeks and then stopped being answered. No machine arrived and no money came back.

The six documents a real machine sale leaves behind

Buyers are usually told to look for warning signs in how a seller behaves. Behaviour is easy to fake and impossible to argue about afterwards. Paperwork is neither. A used compact track loader moving between states generates a specific set of documents, every one of which exists before the money moves and every one of which the buyer can verify with a third party rather than with the seller:

An invoice naming a legal entity, not just a trading name — a corporation or LLC you can look up in the Iowa Secretary of State business entity search along with its registered agent and filing date.
A bill of sale carrying the machine PIN, matching a photograph of the plate on the machine. A Kubota dealer can confirm whether that PIN corresponds to a real 2017 SVL95-2s.
A lien check. Financed equipment carries a UCC-1 filing, searchable for free in the state's UCC index. Buying a machine with a lender's security interest still attached means buying someone else's debt.
A bill of lading issued by the carrier, listing the machine, the pickup yard, and the delivery address.
A carrier you can identify. Every interstate hauler has a USDOT or MC number that resolves in the FMCSA SAFER database, showing whether the company is authorised and insured to operate. A carrier that does not appear there is not hauling anything.
A cargo insurance certificate naming the machine and covering it in transit, issued by the insurer rather than forwarded by the seller.

By the reporter's account, none of these six were issued at any point. That is the substance of this report. A seller who cannot produce an entity name, a PIN, or a carrier identifier is not a dealer having an administrative problem — those three items are the minimum a legitimate yard generates automatically, because its own accountant, insurer, and lender require them.

Why the wire is the pressure point

Wire fraud in equipment sales works precisely because a wire request is normal here. Dealers genuinely do prefer them on five-figure machines, buyers genuinely do purchase sight-unseen across state lines, and nobody blinks at being asked to send funds before a loader is loaded. Nothing unusual has to be invented.

What changes is the sequence. A legitimate sale puts documents in the buyer's hands first and payment second, or splits the difference with escrow or payment on loading. A fraudulent one inverts it: the money must travel on the one rail with no chargeback, no dispute window, and no buyer protection, before anything verifiable exists. Once a wire settles, whether the money can be retrieved depends entirely on whether it is still sitting in the receiving account — which is why the next section is organised as a clock.

The recovery clock

The window opens when the payment settles, not when you realise. Working through it in order matters more than working through it thoroughly.

Same day. Call your own bank's fraud line before you call the seller again. Ask them to initiate a wire recall and send an indemnity (hold harmless) request to the beneficiary bank. Ask for the IMAD number — the Fedwire trace identifier — and a case reference, and ask whether the funds are still in the receiving account. Those two identifiers are what every later filing will be built on.
First 72 hours. File at ic3.gov with the wire details and the beneficiary account. The FBI's Recovery Asset Team can reach a receiving bank far faster than a private complaint can, but it is only useful while the money is still there.
First week. File a police report where you live — banks, insurers, and card issuers frequently require the report number before they will act further. Report to the FTC at ReportFraud.ftc.gov, and for an Iowa-based seller, to the Iowa Attorney General's Consumer Protection Division. Send the receiving bank's fraud department a written notice of your own; the recall from your bank and a direct complaint are handled by different teams.
Ongoing. Preserve the listing page, the wire confirmation, and the complete message thread, exported rather than screenshotted where possible. Refuse every firm that contacts you afterwards offering to recover the money for a fee up front — victim lists circulate, and that approach is a second attempt on the same person.

Before the next wire: ask for documents, not reassurance

The useful question to a seller is never "are you legitimate". It is "send me the PIN plate photograph, the entity name on your invoice, and the MC number of the carrier". A real yard answers all three inside a day because it already has them on file. If any one of the three cannot be produced, nothing else about the deal needs evaluating — and an address on a website, including the one on this page, is not evidence that a business trades from it until you have checked it against the county assessor's parcel records and independent imagery.

1e:["$","div",null,{"className":"shell py-10 md:py-14","children":["$","$15",null,{"fallback":["$","p",null,{"className":"label-mono","children":"Loading alerts…"}],"children":["$","$L1f",null,{"reports":[{"slug":"superiorequipandrent-com","domain":"superiorequipandrent.com","businessName":"Superior Equipment & Rental","title":"Scam Reported: Superior Equipment & Rental, Sheldon, Iowa","metaTitle":"Superior Equipment & Rental Scam Report — superiorequipandrent.com, Sheldon IA ($26,000 Wire, No Delivery)","metaDescription":"A buyer reports wiring $26,000 to Superior Equipment & Rental (superiorequipandrent.com, 2231 Park St, Sheldon, IA 51201) for a 2017 Kubota SVL95-2s track loader that never arrived. Not one of the six documents a legitimate interstate machine sale produces — invoice, PIN on the bill of sale, UCC lien search, bill of lading, carrier MC number, cargo insurance — was ever issued. Includes the full account and an hour-by-hour wire recall plan.","category":"fake-storefronts","riskLevel":"confirmed-scam","siteStatus":"online","summary":"A buyer reports losing $26,000 to Superior Equipment & Rental of Sheldon, Iowa, on a 2017 Kubota SVL95-2s compact track loader advertised at superiorequipandrent.com/listing/2017-kubota-svl95-2s. What makes the account checkable is the paperwork rather than the sale. A used machine crossing state lines normally generates an invoice naming a legal entity, a bill of sale carrying the machine PIN, a lien search, a bill of lading against a carrier with an MC number, and a cargo insurance certificate. By the reporter's account, not one of those documents was ever issued. The seller required the full amount by bank wire ahead of release, the funds settled, and the phone and sales address went quiet.","firstReportedAt":"2026-09-12","lastUpdatedAt":"2026-09-15","lastCheckedAt":"2026-09-15","reportedLossUsd":26000,"victimCount":1,"aliases":["Superior Equipment and Rental","Superior Equip & Rent"],"phones":["(712) 216-4264"],"emails":["sales@superiorequipandrent.com"],"addresses":["2231 Park St, Sheldon, IA 51201"],"paymentMethods":["Bank wire transfer, full amount in advance"],"bankDetails":[],"nameservers":[],"clonedFrom":[],"wallets":[],"handles":[],"platforms":["Equipment listing page at superiorequipandrent.com/listing/2017-kubota-svl95-2s","Direct phone and email with the seller's sales contact"],"redFlags":["Payment demanded in full by wire before a single transferable document existed — no signed bill of sale, no carrier booking, nothing the buyer could hold","No PIN plate photograph, so the machine described in the listing was never tied to a physical unit anyone could trace","No bill of lading and no carrier name with a USDOT or MC number, for a machine supposedly moving between states","Nothing naming a legal entity — no invoice, bill of sale, or W-9 — that could be checked against the Iowa business register","No cargo insurance certificate and no escrow option offered on a $26,000 transaction","Replies were prompt up to settlement, turned into scheduling excuses, then stopped entirely once recall time had run out","Listing for the same unit remained published after the reported non-delivery"],"timeline":[{"date":"2026-08-03","title":"Listing found","detail":"The buyer found a 2017 Kubota SVL95-2s compact track loader advertised at superiorequipandrent.com/listing/2017-kubota-svl95-2s."},{"date":"2026-08-05","title":"Contact with the seller","detail":"Discussed price and delivery by phone on (712) 216-4264 and by email with sales@superiorequipandrent.com."},{"date":"2026-08-11","title":"Wire sent","detail":"$$26,000 sent by bank wire for the full purchase price, as the seller required before release."},{"date":"2026-08-12","title":"Funds cleared","detail":"The wire settled at the receiving bank."},{"date":"2026-08-19","title":"Delivery window passed","detail":"No machine arrived. No bill of lading, carrier name, or transport booking was provided."},{"date":"2026-08-26","title":"Contact stopped","detail":"Calls and emails went unanswered after a short series of reassurances about scheduling."},{"date":"2026-09-12","title":"Report filed","detail":"Filed with the wire confirmation, the listing page, and the full email thread."},{"date":"2026-09-15","title":"Alert published","detail":"Published; the listing was still reachable at the last check."}],"victimAccounts":[{"name":"Reporting buyer","location":"United States","amountUsd":26000,"paymentMethod":"Bank wire transfer","date":"2026-08-11","account":"The buyer needed a compact track loader and found a 2017 Kubota SVL95-2s listed by Superior Equipment & Rental. Dealing went through the number and sales address published on the site. He was told the machine could not be held or released until the full amount arrived by wire, so he sent $26,000 on August 11 and it settled the next day. Everything he asked for in writing — the PIN plate photograph, the carrier the machine would move on, a signed bill of sale — was promised rather than sent. When the delivery window passed there was no machine and no transport paperwork, only short scheduling excuses, and then nothing at all. He never took delivery and has recovered none of the money."}],"evidence":[{"kind":"payment","label":"Wire confirmation supplied","detail":"The reporter provided his bank's outgoing wire confirmation for $26,000 dated 2026-08-11, together with the settlement advice showing the funds cleared on 2026-08-12."},{"kind":"content","label":"Listing page captured","detail":"The advertised unit at superiorequipandrent.com/listing/2017-kubota-svl95-2s was captured at the time of the report and was still reachable at the last check on 2026-09-15."},{"kind":"communication","label":"Contact thread ends after settlement","detail":"The email thread with sales@superiorequipandrent.com shows active replies up to the wire, short scheduling excuses afterwards, and no response at all after 2026-08-26."},{"kind":"contact","label":"Document ledger is empty","detail":"Checked against the six documents an interstate machine sale of this size normally produces: invoice naming a legal entity, bill of sale carrying the PIN, lien search, bill of lading, carrier identifier, and cargo insurance certificate. The reporter was able to supply none of them, because none were issued."},{"kind":"other","label":"Right of reply is open","detail":"This record is published from one buyer's first-hand account and the documents he supplied. Superior Equipment & Rental can respond, or supply proof of delivery or refund, through the corrections page; the record will be updated or withdrawn if the evidence supports it."}],"relatedDomains":[],"bodyHtml":"$20","sample":false},{"slug":"verdant-solar-rebate-example-com","domain":"verdant-solar-rebate.example.com","businessName":"Verdant Solar Rebate Scheme","category":"other","riskLevel":"under-review","siteStatus":"online","summary":"Verdant Solar Rebate Scheme advertises a government-backed solar rebate and collects a processing fee plus identity documents through a portal. No confirmed loss has been reported yet, but the scheme name does not appear in any government programme register, the domain is nine weeks old, and the document upload flow requests more identity material than any rebate requires.","riskScore":46,"domainRegistered":"2026-06-14","firstReportedAt":"2026-08-09","lastUpdatedAt":"2026-08-19","lastCheckedAt":"2026-08-19","reportedLossUsd":0,"victimCount":0,"aliases":["National Solar Rebate Office"],"phones":["+1 (415) 555-0173"],"emails":["claims@verdant-solar-rebate.example.com"],"addresses":["Uses a government department's real street address without authorisation"],"paymentMethods":["Card 'processing fee'","Bank transfer"],"bankDetails":[{"bank":"Payment processor","accountName":"Verdant Claims Co","accountNumberMasked":"••••8104","country":"US"}],"registrar":"Privacy-shielded registrar","nameservers":["ns1.claimhost.example.com","ns2.claimhost.example.com"],"hostingProvider":"Shared VPS","serverCountry":"US","clonedFrom":["A government energy department's page layout, seal, and accessibility footer"],"wallets":[],"handles":["@verdant.rebate (social ads)"],"platforms":["Paid social ads","Cold SMS"],"redFlags":["Uses a government seal and street address without authorisation","Scheme name does not appear in any government programme register","Requests passport, licence, and utility bill images before any eligibility check","Charges an upfront processing fee for a rebate application","Domain registered nine weeks before the first report"],"timeline":[{"date":"2026-06-14","title":"Domain registered"},{"date":"2026-07-20","title":"Advertising begins","detail":"Paid social and cold SMS driving to a claim portal."},{"date":"2026-08-09","title":"First alert filed","detail":"Filed by a recipient who checked the programme register before paying."},{"date":"2026-08-19","title":"Under review","detail":"Published for transparency while verification continues."}],"victimAccounts":[],"evidence":[{"kind":"whois","label":"Domain age","detail":"Registered 2026-06-14, nine weeks old at the first report."},{"kind":"content","label":"Unauthorised government branding","detail":"Seal, layout, and accessibility footer copied from a government energy department."},{"kind":"contact","label":"Programme not registered","detail":"The scheme name does not appear in the relevant government programme register."},{"kind":"payment","label":"Upfront fee","detail":"A processing fee is charged before any eligibility assessment."}],"relatedDomains":[],"sample":true},{"slug":"asset-reclaim-unit-example-com","domain":"asset-reclaim-unit.example.com","businessName":"Asset Reclaim Unit","category":"recovery-support","riskLevel":"confirmed-scam","siteStatus":"online","summary":"Asset Reclaim Unit approaches people who have already lost money, quoting the exact amount and platform involved. It presents a case portal showing 'recovered' funds and requests a retainer, a blockchain gas fee, and a release tax. Five people who had already been defrauded lost a further $46,900. The contact handle is shared with a trading platform in this feed.","riskScore":93,"domainRegistered":"2026-06-20","firstReportedAt":"2026-07-29","lastUpdatedAt":"2026-08-18","lastCheckedAt":"2026-08-19","reportedLossUsd":46900,"victimCount":5,"aliases":["Global Asset Reclaim","Blockchain Tracing Unit","ARU Chambers"],"phones":["+1 (202) 555-0147 (VoIP)"],"emails":["cases@asset-reclaim-unit.example.com"],"addresses":["Cites a Washington, DC address occupied by a registered agent service"],"paymentMethods":["USDT (TRC-20)","Bank transfer","Gift card codes for 'filing fees'"],"bankDetails":[{"bank":"Payment institution","accountName":"ARU Services LLC","accountNumberMasked":"••••6620","country":"US"}],"registrar":"Privacy-shielded registrar","nameservers":["ns1.edge-shield.example.com","ns2.edge-shield.example.com"],"hostingProvider":"CDN-fronted VPS","serverCountry":"Unknown (proxied)","clonedFrom":["A genuine blockchain analytics firm's methodology pages and certification badges"],"wallets":["TRC-20 ••••••••4c81b"],"handles":["@aru.casedesk","Case officer 'Alicia Grant'","'Regulatory liaison' account on two messengers"],"platforms":["Cold messenger contact","Cold email to prior victims","Comment replies under scam-warning videos"],"redFlags":["Contacts victims first and already knows the amount lost and the platform involved","Charges an upfront retainer to return money, which no genuine agency does","Case portal displays a recovered balance that cannot be withdrawn without further fees","Claims a regulatory mandate no regulator issues, and collects fees through wallets and gift cards","Shares nameservers and a messenger handle with a trading platform already in this feed","Requests remote access to the victim's device to 'verify the wallet'"],"timeline":[{"date":"2026-06-20","title":"Domain registered","detail":"Same nameservers as an active trading platform in this feed."},{"date":"2026-07-11","title":"First reported contact","detail":"Cold messenger approach quoting an exact prior loss figure."},{"date":"2026-07-24","title":"First retainer paid","detail":"$$7,500 retainer plus a $2,100 'gas fee'."},{"date":"2026-07-29","title":"First alert filed"},{"date":"2026-08-18","title":"Release tax demanded","detail":"A 9 percent 'release tax' requested before any payout."},{"date":"2026-08-19","title":"Still live","detail":"Case portal and intake form functional at the last check."}],"victimAccounts":[{"name":"Andrew","location":"Kent, UK","amountUsd":18600,"paymentMethod":"USDT and bank transfer","date":"2026-07-24","account":"Had already lost money on a trading platform. Was contacted by someone who knew the exact figure and the platform name, and who sent a case file with a reference number. Paid a $7,500 retainer, then a $2,100 gas fee, then a partial release tax. The portal showed his funds as recovered the entire time. It was the same messenger handle he had spoken to on the original platform."},{"name":"N.D.","location":"Ohio, US","amountUsd":12400,"paymentMethod":"Bank transfer","date":"2026-08-04","account":"Was told a court order had been secured and only a filing fee remained. The case number did not correspond to any court record when checked."},{"name":"F.A.","location":"Cape Town, ZA","amountUsd":9200,"paymentMethod":"Gift card codes","date":"2026-08-12","account":"Was asked for gift card codes for an 'international filing fee', and granted a remote session so the agent could 'verify the wallet'. Two further accounts were accessed during that session."}],"evidence":[{"kind":"communication","label":"Victim list reuse","detail":"Opening messages quote loss amounts that match earlier reports about a specific platform."},{"kind":"hosting","label":"Shared infrastructure","detail":"Same nameservers as an active trading platform in this feed."},{"kind":"payment","label":"Advance-fee structure","detail":"Retainer, gas fee, then release tax, all payable before anything is returned."},{"kind":"content","label":"Copied credentials","detail":"Methodology pages and certification badges taken from a genuine analytics firm."},{"kind":"contact","label":"Registered agent address","detail":"The DC address is a registered agent service with no offices for this entity."}],"relatedDomains":["meridian-capital-desk.example.com","reclaim-case-portal.example.com"],"sample":true},{"slug":"meridian-capital-desk-example-com","domain":"meridian-capital-desk.example.com","businessName":"Meridian Capital Desk","category":"investment-crypto","riskLevel":"confirmed-scam","siteStatus":"online","summary":"Meridian Capital Desk presents itself as a licensed derivatives brokerage with a live trading dashboard and an assigned account manager. Deposits are accepted in USDT and by bank transfer, balances rise on screen, and withdrawals are blocked behind a 12 percent 'liquidity clearance' fee. Four people reported a combined $214,000. The platform was still accepting deposits at the last check.","riskScore":96,"domainRegistered":"2026-02-11","firstReportedAt":"2026-06-14","lastUpdatedAt":"2026-08-18","lastCheckedAt":"2026-08-19","reportedLossUsd":214000,"victimCount":4,"aliases":["Meridian Desk Markets","MCD Global Markets Ltd"],"phones":["+44 20 7946 0102 (VoIP, unassigned range)"],"emails":["compliance@meridian-capital-desk.example.com","m.hale.desk@proton-alias.example.com"],"addresses":["Claims a 14th-floor London address that is a virtual office mail forwarder"],"paymentMethods":["USDT (TRC-20)","Bank transfer to a payment institution","Card top-up via a third-party processor"],"bankDetails":[{"bank":"E-money institution, Lithuania","accountName":"MCD Processing OU","accountNumberMasked":"LT••••8841","country":"LT"}],"registrar":"Privacy-shielded registrar","nameservers":["ns1.edge-shield.example.com","ns2.edge-shield.example.com"],"hostingProvider":"CDN-fronted VPS","serverCountry":"Unknown (proxied)","clonedFrom":["A regulated European brokerage (licence text, risk disclosure, and team photos copied verbatim)"],"wallets":["TRC-20 ••••••••9f4c2 (reported by three separate depositors)"],"handles":["@meridian.desk.official (messenger)","Account manager 'Marcus Hale'"],"platforms":["Paid search ads","Messenger cold contact","A finance-themed video channel"],"redFlags":["Quotes a regulator licence number that belongs to an unrelated, genuinely regulated firm","Withdrawals blocked behind a 12 percent fee payable from outside the account balance","Domain registered four months before the first reported deposit, behind WHOIS privacy from day one","Dashboard shows filled positions with no corresponding trade confirmations or venue references","Account manager contacted every depositor within minutes of registration, before any deposit","Deposit wallet is shared with two other platforms reported to us in the same quarter","Risk disclosure and licence page copied word for word from a regulated brokerage"],"timeline":[{"date":"2026-02-11","title":"Domain registered","detail":"Privacy-shielded registration, CDN-fronted from the first day."},{"date":"2026-03-30","title":"Advertising begins","detail":"Paid search and video placements targeting retail investors."},{"date":"2026-05-02","title":"First reported deposit","detail":"$$18,000 in USDT after a $500 test deposit and a successful $400 withdrawal."},{"date":"2026-06-08","title":"Withdrawal blocked","detail":"A 12 percent 'liquidity clearance' fee demanded before release."},{"date":"2026-06-14","title":"First alert filed","detail":"Filed with wallet transaction hashes and full chat logs."},{"date":"2026-07-21","title":"Second extraction","detail":"Depositors contacted by a 'regulatory recovery unit' using the same chat handle."},{"date":"2026-08-19","title":"Still live","detail":"Registration and deposit flow functional at the last check."}],"victimAccounts":[{"name":"Daniel","location":"Ontario, CA","amountUsd":96000,"paymentMethod":"USDT (TRC-20)","date":"2026-05-02","account":"Found the platform through a paid search result while comparing brokers. An account manager called within ten minutes of registration. Daniel deposited $500, was walked through two trades that showed a gain, and withdrew $400 without any friction. Over six weeks he deposited a further $95,500. When he requested $40,000 the platform demanded a 12 percent liquidity clearance fee paid separately in USDT. He paid $11,400 of it before stopping. Nothing was ever released."},{"name":"P.R.","location":"Singapore","amountUsd":62000,"paymentMethod":"Bank transfer","date":"2026-05-27","account":"Transferred funds to a Lithuanian e-money account whose beneficiary name did not match the brand on the invoice. The dashboard showed positions in three indices, but no trade confirmations or venue references were ever issued."},{"name":"A.K.","location":"Texas, US","amountUsd":41000,"paymentMethod":"USDT (TRC-20)","date":"2026-06-19","account":"Was told a compliance hold could be cleared with a tax pre-payment. Six weeks later the same messenger handle reappeared as a 'regulatory recovery unit' offering to retrieve the funds for a retainer."},{"name":"L.M.","location":"Queensland, AU","amountUsd":15000,"paymentMethod":"Card top-up","date":"2026-07-04","account":"Card top-up was processed by an unrelated merchant descriptor, which delayed the chargeback because the transaction did not appear to relate to a brokerage."}],"evidence":[{"kind":"whois","label":"Domain age at first deposit","detail":"81 days. Registered 2026-02-11, first reported deposit 2026-05-02."},{"kind":"content","label":"Copied licence text","detail":"Licence and risk disclosure pages match a regulated European brokerage word for word, including its registration number."},{"kind":"payment","label":"Shared deposit wallet","detail":"The TRC-20 deposit address appears in two other alerts filed in the same quarter."},{"kind":"payment","label":"Beneficiary mismatch","detail":"Bank beneficiary name does not match the brand or entity on the invoice."},{"kind":"communication","label":"Fee-on-fee escalation","detail":"Liquidity clearance, then a tax pre-payment, then a recovery retainer, all payable outside the account."},{"kind":"hosting","label":"Infrastructure reuse","detail":"Shares nameservers with two other trading platforms registered the same week."}],"relatedDomains":["meridian-clearance-portal.example.com","asset-reclaim-unit.example.com"],"sample":true},{"slug":"brightpath-task-hub-example-com","domain":"brightpath-task-hub.example.com","businessName":"BrightPath Task Hub","category":"employment-task","riskLevel":"high-risk","siteStatus":"online","summary":"BrightPath Task Hub recruits through messenger apps for paid 'listing optimisation' work. Early payouts of $20 to $60 are genuine, then tasks require the worker to deposit their own funds to unlock a commission tier, and a deliberate task error locks the balance until a correction fee is paid. Six workers reported $27,800. The platform remains online and recruiting.","riskScore":78,"domainRegistered":"2026-05-29","firstReportedAt":"2026-07-25","lastUpdatedAt":"2026-08-17","lastCheckedAt":"2026-08-19","reportedLossUsd":27800,"victimCount":6,"aliases":["BrightPath Remote Team","BP Task Center"],"phones":[],"emails":["hr@brightpath-task-hub.example.com"],"addresses":["Claims a Kuala Lumpur office address occupied by a coworking provider"],"paymentMethods":["USDT (TRC-20)","Bank transfer to rotating individual accounts"],"bankDetails":[{"bank":"Retail bank, MY","accountName":"Rotating individual names","accountNumberMasked":"••••2244","country":"MY"}],"registrar":"Privacy-shielded registrar","nameservers":["ns1.taskcloud.example.com","ns2.taskcloud.example.com"],"hostingProvider":"CDN-fronted VPS","serverCountry":"Unknown (proxied)","clonedFrom":["A real e-commerce services agency (about page, team bios, and client logos)"],"wallets":["TRC-20 ••••••••1a77e"],"handles":["@brightpath.hr (recruiter)","Trainer 'Coach Wen' in a 40-person group chat"],"platforms":["Messenger cold contact","Job board reposts","Group chat onboarding"],"redFlags":["Workers must deposit their own funds to unlock higher commission tiers","A task error locks the accumulated balance until a correction fee is paid","Recruitment is unsolicited and moves to an encrypted messenger within two messages","Group chat is populated with 'colleagues' posting withdrawal screenshots on cue","Receiving bank accounts rotate between individual names","Some workers are asked to receive and forward third-party payments, which makes them money mules"],"timeline":[{"date":"2026-05-29","title":"Domain registered"},{"date":"2026-07-02","title":"Recruitment begins","detail":"Unsolicited messenger contact citing a job board profile."},{"date":"2026-07-18","title":"First reported deposit","detail":"$$1,200 deposited to unlock a commission tier."},{"date":"2026-07-25","title":"First alert filed"},{"date":"2026-08-13","title":"Mule requests reported","detail":"Two workers asked to receive and forward payments from strangers."},{"date":"2026-08-19","title":"Still recruiting","detail":"Registration and onboarding chat active at the last check."}],"victimAccounts":[{"name":"Priya","location":"Selangor, MY","amountUsd":9400,"paymentMethod":"USDT and bank transfer","date":"2026-07-18","account":"Was contacted about a remote listing-optimisation role after posting a CV on a job board. The first three days paid out about $140 in total, which arrived. Task four required a $1,200 deposit to unlock a higher commission tier. A 'system error' on task six locked the balance and a correction fee was demanded to release it. She paid three times before stopping."},{"name":"J.C.","location":"Manila, PH","amountUsd":6100,"paymentMethod":"USDT (TRC-20)","date":"2026-07-30","account":"Kept depositing because the group chat was full of colleagues posting successful withdrawal screenshots. Later noticed the same screenshots reposted by different accounts with different names."},{"name":"E.B.","location":"Lagos, NG","amountUsd":2300,"paymentMethod":"Bank transfer","date":"2026-08-11","account":"Was asked to receive payments from strangers and forward them onward as part of 'client settlement duties'. Stopped after the bank froze the account and flagged the transactions."}],"evidence":[{"kind":"whois","label":"Domain age","detail":"Registered 2026-05-29, under 60 days old at the first reported deposit."},{"kind":"payment","label":"Deposit-to-earn structure","detail":"Payouts are gated behind worker deposits, which no legitimate employer requires."},{"kind":"content","label":"Copied company identity","detail":"About page, team bios, and client logos taken from a real e-commerce services agency."},{"kind":"communication","label":"Manufactured social proof","detail":"Identical withdrawal screenshots reposted by multiple named accounts in the group chat."},{"kind":"payment","label":"Mule recruitment","detail":"Workers asked to receive and forward third-party funds, exposing them to laundering charges."}],"relatedDomains":["brightpath-worker-portal.example.com"],"sample":true},{"slug":"harbour-lane-connect-example-com","domain":"harbour-lane-connect.example.com","businessName":"Harbour Lane Connect","category":"romance-social","riskLevel":"high-risk","siteStatus":"online","summary":"Harbour Lane Connect is the trading platform at the end of a long-running social approach. Contact begins as a misdirected message, moves to a private messenger, and after several weeks the other person introduces a 'family' trading platform. Three people reported $88,400. Withdrawals require a personal tax certificate that is never issued.","riskScore":74,"domainRegistered":"2026-01-27","firstReportedAt":"2026-06-05","lastUpdatedAt":"2026-08-16","lastCheckedAt":"2026-08-19","reportedLossUsd":88400,"victimCount":3,"aliases":["Harbour Lane Digital","HL Connect Exchange"],"phones":[],"emails":["care@harbour-lane-connect.example.com"],"addresses":["Claims a Hong Kong address that resolves to a serviced office floor"],"paymentMethods":["USDT (TRC-20 and ERC-20)","Peer-to-peer crypto purchase then transfer"],"bankDetails":[],"registrar":"Privacy-shielded registrar","nameservers":["ns1.lanecloud.example.com","ns2.lanecloud.example.com"],"hostingProvider":"CDN-fronted VPS","serverCountry":"Unknown (proxied)","clonedFrom":["A real exchange's app interface and order book layout"],"wallets":["TRC-20 ••••••••7b30d","ERC-20 ••••••••e214f"],"handles":["'Elaine W.' across two messengers","@harbourlane.care (support)"],"platforms":["Misdirected message opener","Dating app then messenger migration","Private group chat"],"redFlags":["The platform is only ever introduced by a private contact, never advertised","Weeks of unrelated conversation precede any mention of money, which defeats most urgency checks","Withdrawals require a 'personal tax certificate' obtainable only by paying a further fee","Deposits are made by buying crypto on a legitimate exchange and transferring it out, which bypasses card protections","Profile photographs reverse-image-match an unrelated person's public social account","Support and the private contact reply with the same phrasing and time signature"],"timeline":[{"date":"2026-01-27","title":"Domain registered"},{"date":"2026-03-14","title":"First reported contact","detail":"A misdirected message that turned into daily conversation."},{"date":"2026-04-29","title":"Platform introduced","detail":"Presented as a family-run trading operation with limited access."},{"date":"2026-05-20","title":"First reported deposit","detail":"$$12,000 in USDT purchased on a legitimate exchange and transferred out."},{"date":"2026-06-05","title":"First alert filed"},{"date":"2026-08-19","title":"Still live","detail":"Platform accessible and accepting deposits at the last check."}],"victimAccounts":[{"name":"Helen","location":"British Columbia, CA","amountUsd":61000,"paymentMethod":"USDT purchased and transferred","date":"2026-05-20","account":"A wrong-number message turned into two months of daily conversation, video calls included. The platform was described as a family operation with limited access, and the first withdrawal of $3,000 worked. She then deposited her retirement savings in stages. The final withdrawal required a personal tax certificate that support said would take five business days, and then eleven weeks, and then another fee."},{"name":"S.V.","location":"Munich, DE","amountUsd":19400,"paymentMethod":"USDT (ERC-20)","date":"2026-06-28","account":"Bought crypto on a regulated exchange and transferred it to a deposit address supplied in the chat, which put the transaction outside any card or transfer dispute process."},{"name":"K.T.","location":"Utah, US","amountUsd":8000,"paymentMethod":"USDT (TRC-20)","date":"2026-07-30","account":"Reverse-image-searched the profile photographs after the second withdrawal failed and found they belonged to an unrelated person with a public social account."}],"evidence":[{"kind":"content","label":"Cloned interface","detail":"Order book and app layout copied from a real exchange, with no matching venue data."},{"kind":"payment","label":"Protection bypass","detail":"Deposits routed through self-purchased crypto, removing card and transfer dispute options."},{"kind":"communication","label":"Single operator","detail":"The private contact and the support desk share phrasing patterns and response timing."},{"kind":"contact","label":"Stolen likeness","detail":"Profile photographs reverse-image-match an unrelated person's public account."}],"relatedDomains":["harbour-lane-tax-clearance.example.com"],"sample":true},{"slug":"parcel-customs-settle-example-com","domain":"parcel-customs-settle.example.com","businessName":"Parcel Customs Settlement (courier impersonation)","category":"phishing-impersonation","riskLevel":"confirmed-scam","siteStatus":"suspended","summary":"A courier impersonation kit delivered by SMS, claiming a parcel was held pending a small customs fee. The payment page harvested full card details and then a one-time passcode in real time, which was used to enrol the card in a mobile wallet. Reported card losses reached $38,600 across 22 people, most of it spent within an hour of the code being entered.","riskScore":94,"domainRegistered":"2026-07-08","firstReportedAt":"2026-07-19","lastUpdatedAt":"2026-08-15","lastCheckedAt":"2026-08-17","reportedLossUsd":38600,"victimCount":22,"aliases":["Global Parcel Settlement","Courier Fee Portal"],"phones":["Sender IDs rotated across 40+ alphanumeric SMS headers"],"emails":[],"addresses":[],"paymentMethods":["Card details harvested directly","Wallet enrolment using a stolen one-time passcode"],"bankDetails":[],"registrar":"Registrar with automated bulk provisioning","nameservers":["ns1.kit-deploy.example.com","ns2.kit-deploy.example.com"],"hostingProvider":"Bulletproof hosting reseller (account suspended)","serverCountry":"RU","clonedFrom":["A national courier's tracking and payment pages, pixel for pixel"],"wallets":[],"handles":[],"platforms":["Bulk SMS","Messaging app forwards"],"redFlags":["Customs fee requested is deliberately trivial, between $1 and $3, to lower scrutiny","Domain registered eleven days before the first reported loss","Page requests a one-time passcode after the card details, which no courier ever needs","Lookalike domain uses the courier's brand as a subdomain prefix, not as the registered domain","Card is enrolled in a mobile wallet within minutes and spent at high-value retail","Kit rotates domains every few days while keeping identical page markup"],"timeline":[{"date":"2026-07-08","title":"Domain registered"},{"date":"2026-07-14","title":"SMS campaign begins","detail":"Bulk send across multiple carriers using rotating sender IDs."},{"date":"2026-07-16","title":"First reported loss","detail":"$$2.10 'fee' followed by $4,200 in wallet transactions within 40 minutes."},{"date":"2026-07-19","title":"First alert filed"},{"date":"2026-08-02","title":"Registrar notified","detail":"Abuse report filed with the registrar and the hosting reseller."},{"date":"2026-08-15","title":"Host suspended","detail":"Hosting account suspended; near-identical domains remain in rotation."}],"victimAccounts":[{"name":"Marcus","location":"New South Wales, AU","amountUsd":4200,"paymentMethod":"Card details and passcode","date":"2026-07-16","account":"Was expecting a delivery, so the message did not seem unusual. Paid a $2.10 customs fee, then entered a code that arrived by SMS. Within forty minutes there were three contactless transactions at electronics retailers in another state. The bank confirmed the card had been added to a mobile wallet on an unrecognised device."},{"name":"H.N.","location":"Auckland, NZ","amountUsd":2650,"paymentMethod":"Card details and passcode","date":"2026-07-21","account":"Noticed the domain looked wrong only after entering the details. Called the bank within fifteen minutes, which limited the loss to two transactions."}],"evidence":[{"kind":"whois","label":"Domain age at first loss","detail":"8 days. Registered 2026-07-08, first reported loss 2026-07-16."},{"kind":"content","label":"Pixel-identical clone","detail":"Markup and assets match the courier's real tracking and payment pages."},{"kind":"communication","label":"Passcode harvesting","detail":"The page requests a one-time passcode after card entry and relays it to an operator in real time."},{"kind":"hosting","label":"Kit rotation","detail":"Fourteen sibling domains served identical markup from the same hosting range."}],"relatedDomains":["parcel-fee-settle.example.com","courier-hold-release.example.com"],"sample":true},{"slug":"northgate-outlet-store-example-com","domain":"northgate-outlet-store.example.com","businessName":"Northgate Outlet Store","category":"fake-storefronts","riskLevel":"confirmed-scam","siteStatus":"offline","summary":"Northgate Outlet Store ran paid social advertising for premium electronics and outerwear at roughly a third of retail. Card payments failed by design at checkout, after which buyers were offered a bank transfer. Nine buyers reported $14,300 in total; most received nothing, three received substituted low-value items shipped from a drop address to generate tracking numbers.","riskScore":91,"domainRegistered":"2026-04-02","firstReportedAt":"2026-06-30","lastUpdatedAt":"2026-08-11","lastCheckedAt":"2026-08-18","reportedLossUsd":14300,"victimCount":9,"aliases":["Northgate Clearance","NG Outlet Direct"],"phones":[],"emails":["support@northgate-outlet-store.example.com"],"addresses":["Footer address belongs to a closed retail unit in Manchester"],"paymentMethods":["Bank transfer","Instant payment app","Gift card balance"],"bankDetails":[{"bank":"Retail bank, UK","accountName":"N. Adeyemi","accountNumberMasked":"••••3072","country":"GB"},{"bank":"Payment app account","accountName":"NG Retail","accountNumberMasked":"••••9915","country":"GB"}],"registrar":"Bulk registrar","nameservers":["ns1.hostpool-ads.example.com","ns2.hostpool-ads.example.com"],"hostingProvider":"Shared hosting reseller","serverCountry":"US","clonedFrom":["Product catalogues from two national retailers, including photography and copy"],"wallets":[],"handles":["@northgate.outlet (social ads)","Support chat operator 'Ellie'"],"platforms":["Paid social ads","Influencer story placements"],"redFlags":["Card checkout fails on every attempt, then offers a bank transfer as the alternative","Beneficiary on the transfer is an individual, not the trading name","Every product page runs the same countdown timer, which resets on reload","Reviews are dated before the domain was registered","Prices are roughly one third of the manufacturer's minimum advertised price across the whole catalogue","Footer address is a retail unit that closed two years ago"],"timeline":[{"date":"2026-04-02","title":"Domain registered"},{"date":"2026-05-18","title":"Paid social campaign begins","detail":"Ads placed across two platforms with the same creative set."},{"date":"2026-06-11","title":"First reported transfer","detail":"£640 for a laptop after the card checkout failed twice."},{"date":"2026-06-30","title":"First alert filed"},{"date":"2026-07-22","title":"Substituted goods reported","detail":"Three buyers received low-value items with valid tracking numbers."},{"date":"2026-08-09","title":"Site offline","detail":"Domain stopped resolving; the same catalogue reappeared on a new domain."}],"victimAccounts":[{"name":"Sofia","location":"Greater Manchester, UK","amountUsd":810,"paymentMethod":"Bank transfer","date":"2026-06-11","account":"Clicked an ad for a laptop at about a third of retail. The card form failed twice with a generic error, then a chat operator offered a bank transfer with a five percent discount for 'saving processing fees'. The beneficiary was an individual's name. A tracking number arrived four days later and delivered a phone case."},{"name":"T.O.","location":"Dublin, IE","amountUsd":1240,"paymentMethod":"Instant payment app","date":"2026-06-24","account":"Paid by instant transfer because the site said card processing was down for maintenance. Support replied for eleven days with shipping updates, then stopped."},{"name":"R.S.","location":"Alberta, CA","amountUsd":420,"paymentMethod":"Gift card balance","date":"2026-07-02","account":"Was asked to settle the balance with gift card codes to 'release a held order'. The codes were redeemed within minutes and the order never shipped."}],"evidence":[{"kind":"content","label":"Copied catalogue","detail":"Product photography and descriptions match two national retailers across more than 400 listings."},{"kind":"content","label":"Backdated reviews","detail":"Review timestamps predate the domain registration date by several months."},{"kind":"payment","label":"Individual beneficiary","detail":"Transfers were directed to a personal account, not a business account in the trading name."},{"kind":"hosting","label":"Catalogue redeployed","detail":"The identical catalogue reappeared on a new domain nine days after this one went offline."}],"relatedDomains":["northgate-clearance-uk.example.com"],"sample":true}]}]}]}]

Every published alert, newest first