Linked Clusters Behind 173 Fake-ID, Drug and Carding Shop Records: Shared Identifiers, Kits and Servers

TLP:CLEAR · ScamMinder Research · Data as of 20 October 2026 · Revised 20 October 2026 (fourth revision) · Companion to One Contact, Many Scam Sites (September 2026)

Websites that openly sell fake driver's licences, passports, diplomas, cocaine, MDMA, stolen card data and counterfeit cash look like hundreds of unrelated shops. Many of them are linked. ScamMinder's casework detector has flagged 173 such records, 169 distinct registrable domains (a path record and its root count separately; one record, a consumer sexual-health shop, was removed from the study after review). When we traced their shared trackers, contact accounts, servers, page templates and cross-links, and checked each lead against urlscan.io, twelve clusters stood out. The lettered sections are illustrative groupings of the records with the strongest links, not a partition of the whole study: many records belong to no lettered cluster and appear only in the indicator tables, and some belong to two (overlaps are listed in the method section). The evidence behind each cluster differs: a few are tied by identifiers only an operator controls, others by a resold kit or a shared server, and some are candidate sets that still need validation. We say which is which.

Key findings

• Three small groups of fake-ID shops are tied by identifiers an operator controls. idlord[.]com and idpapa[.]com load the same Matomo Cloud analytics tenant and the same tracking host; idgod[.]ph and idpimp[.]ph print the same Telegram account and WhatsApp number; idpark[.]cc and idpark[.]ph shared a Telegram handle in 2024. Chinese business-mail providers and Registrar.eu registrations are context around these groups, not proof of who runs them or where.
• "IDGod" is a brand name used by several hosters' worth of sites. The 2004 idgod[.]com, the Kyiv-hosted idgod[.]ph and three Hostinger-hosted clones share the name and little else we could verify; whether they share an operator is unresolved.
• Drug "shops" cross-link in rings and use the advance-fee playbook. Footer link farms tie dozens of cocaine, meth, fentanyl, cannabis, counterfeit-money and clone-card storefronts together, with Gmail and Proton inboxes, forwarding numbers and crypto or app payments. The pattern matches long-documented advance-fee shops; we did not verify non-delivery for any individual site.
• A handful of hosting networks carry the trade. Hostinger shared hosting is the most common visible origin for drug shops; FranTech/BuyVM, Virtual Systems (Kyiv), Omegatech, SpectraIP, PureVoltage and WIBO Baltic each host whole clusters, usually beside unrelated customers. Cloudflare hides the origin of 69 of the 121 corpus records that still resolved.
• The candidate families are far bigger than any one shop. urlscan.io results dated 22 July to 20 October 2026 contain 274 registrable domains returned by a Russian diploma-purchase title-phrase search (118 with ГОЗНАК in the title), 188 filtered "Кракен" gateway candidates, 101 "onion links" mirror pages and 27 "Authorize" carding storefronts: 646 distinct registrable domains outside this study's corpus once the families are merged (647 in all; one, distrodelsanto[.]com, is a corpus record, and six are present somewhere in the full ScamMinder database). These are title-matched candidate sets, not verified memberships.
• Contact details outlive domains. Of the 35 pages that rendered an illicit-goods storefront, 14 link a Telegram or WhatsApp account and 21 name Bitcoin; those identifiers, not hostnames, are what link a group.

Method: how websites are linked, and what each link proves

ScamMinder's casework detector reads every captured page for the vocabulary of illicit trade (scannable IDs, security features, "fullz", "dumps", controlled substances, discreet shipping, crypto-only payment) and opens a case when the words and the shop structure both match. Casework holds 104 open or confirmed cases on 71 hosts in the illicit-goods, counterfeit-documents, carding and darknet-market families. For this report we took those hosts plus every other corpus record whose title or category fits, then removed one record whose current page sells consumer sexual-health products rather than illicit goods, leaving 173 corpus records (169 registrable domains), and worked outward. A second record, a privacy hosting provider that the fraud-tooling detector flagged, is carried only as an infrastructure lead and is excluded from every statistic. The 49 rendered pages and the 35-storefront payment population used later are subsets of the 71 casework hosts, not of the 173. Overlaps are generated from the published tables. Records in two lettered groups: distrodelsanto[.]com (C and F linked targets); idgod[.]ph (A2 and B). Records that appear both in a lettered group and in an indicator category table, or in two category tables: authenticdocsagency[.]com (C leads, documents table); billsbuffbanknotes[.]com (C leads, counterfeit-money table); counterfeitfutures[.]com (F linked targets, counterfeit-money table); counterfeitguru[.]com (F, counterfeit-money table); getcardsclones[.]com (F linked targets, counterfeit-money table); trustedbillsandclones[.]com (F, counterfeit-money table). Every other record appears once.

Three kinds of evidence were combined. They are graded, and the grade is stated at every cluster:

• Shared operator identifiers (strongest): a Telegram or WhatsApp account, a private inbox, an analytics tenant or tracking host found on several shops. These come from ScamMinder's evidence ledger and from the DOM snapshots urlscan.io captured for us. Even here, a shared tenant or tracker can reflect a common contractor rather than a common owner.
• Shared kit, title, template, brand or cross-links (medium): identical page titles, naming patterns (authorize*.*, *-diplom*.ru), a shared page-builder fingerprint, a borrowed brand name, or footer link rings. Kits are resold and brands are copied, so these show a family, not an owner.
• Shared infrastructure (weakest): an origin IP, name-server set, registrar or mail provider. We report it as context; it never creates a cluster on its own, shared Cloudflare edge addresses were ignored, and where a server also hosts unrelated sites we say so.

urlscan.io was used in two ways. We submitted unlisted scans of the 71 casework hosts on 20 October 2026 and read the resulting DOM, requests and links; the outcome of every submission, with its scan id, is in the manifest below. We also pivoted through its search index by page title, origin IP and hosting network. Every count from the index is reported for a defined observation window, the results returned were dated 22 July to 20 October 2026, and search visibility depends on each scan's public, unlisted or private setting and on account access, so a zero result does not mean a site was never scanned. Counts give the unit (scans, hostnames or registrable domains) and the inclusion rule. Wallet-like strings were validated with Base58Check and discarded when they sat inside encoded image data; none survived. Every classification of a page in this article describes what the 20 October browser rendered; where a site's category comes from an earlier ScamMinder capture, the text says so.

The clusters

A. Fake-ID shops tied by shared operator identifiers (three groups, 9 sites)

Evidence class: shared operator identifiers for the core pairs; link, naming and ledger evidence for the rest. Grade: high for the pairs, lower for each added member; no verified bridge between the groups.

A1 (2 sites plus 2 leads). Verified: idlord[.]com and idpapa[.]com both request the Matomo Cloud tenant yoloids.matomo.cloud and the tracking host an.kingdream.vip (scans 01a159d8… and 01a159d8…). A shared tenant may mean one operator or one contractor; the exact match of two operator-side resources is still the strongest link in this report. Lead: idlord.com's "Shop Now" button links to idlord[.]ph, which was not scanned. Candidate: the tenant is named "yoloids", the name of a third shop, yoloids[.]com; that site was not scanned, did not appear in any urlscan.io result we retrieved, and its ownership is unverified (ScamMinder's own capture records it on Alibaba Cloud with a Chinese registrant). Both scanned shops also use Alibaba enterprise mail and Registrar.eu, which is context, not a link.

A2 (3 sites). idgod[.]ph and idpimp[.]ph print the same Telegram account idgodphfakeidscom and the same WhatsApp number +1 601 658 0419 (01a159d8…, 01a159d8…). ScamMinder's ledger also records the idgod.ph inbox on idgod[.]com[.]ph, now dead.

A3 (2 sites). idpark[.]cc and idpark[.]ph carried one Telegram handle in ScamMinder's 2024 captures; both are dead now and could not be re-scanned.

Leads, not links. idtop[.]ph and idbook[.]ph use Telegram channels with the same naming convention (idzone_Discount, idbook_Discount), Netease and QQ business mail and Tencent DNSPod, and idtop.ph loads analytics.pugos.cn; none of that is a shared identifier, so they stay outside A. idtop[.]is, scannablefakeid[.]eu and fakeid[.]pm share a page-builder fingerprint with idlord.com and idpapa.com (a template family). All of these shops price US state licences in dollars with bulk discounts and offer Bitcoin, USDT or gift codes, but language, mail provider and registration data say nothing reliable about who the operator is or where they sit.

B. "IDGod" brand-use group (6 domains) and the other fake-ID shops

Evidence class: shared brand name. Grade: operator relationship unresolved.

idgod[.]com, registered in 2004 and advertising "18 years online", is served from Omegatech LTD (Netherlands IP, Seychelles-registered network, 01a159d8…); another fake-ID shop, bogusbraxtor[.]com, appears on the same network in urlscan.io search. idgod[.]ph runs on Virtual Systems LLC in Kyiv behind stop-ddos.net name servers and belongs to group A2. Hostinger hosts three more sites using the name: idgodfakeids[.]com, idgod[.]shop and buyfakeidonline[.]cc. A shared brand establishes neither common nor independent ownership; what it does show is that a buyer searching for "IDGod" cannot tell which site, if any, is the one others copy. The rest of the fake-ID market is a long tail: drunkid[.]com, fakeyourdrank[.]com, evolvedids[.]com, myfakeid[.]biz (UK, Hushmail), fakeidworld[.]com (Poland, Smarthost), the barcode generator barcodes[.]fakeidsolutions[.]com, and a Hetzner-hosted "ID Rocket" trio.

C. Six drug shops on one FranTech origin address (6 sites, plus 10 leads on the same network)

Evidence class: shared origin IP 198.251.84.129 (AS53667 FranTech / BuyVM, Luxembourg). Grade: same server; ownership unresolved.

distrodelsanto[.]com prints a Telegram handle, an Australian WhatsApp number, a Proton inbox and a San Jose street address. urlscan.io's page.ip search for its origin address returned 612 scans of 312 hostnames dated 22 July to 20 October 2026, among them mdmadelivery[.]co[.]uk (01a0b92f…), mdmadelivery[.]ca (01a13d96…), ukcocainedelivery[.]com (01a12cf2…), cocainedelivery[.]ca (01a0c132…) and alphamms[.]co (oxycodone, 019faa16…). Four of the six use a country-and-"delivery" name. The same address also serves fake banks, a Monzo phishing page and parcel-tracking scams, so it is a shared abusive host; we did not establish a shared kit through code or assets, and we do not claim one operator. Ten more drug, counterfeit-money and bank-log shops that the first version placed on this server (buycocaineonlinedubai[.]com, cnento[.]com, psychedelicbird[.]com, buyshrooms[.]ca, billsbuffbanknotes[.]com, undetectablepropandcounterfeit[.]net, authenticdocsagency[.]com, oakslog[.]com, mindfoodshop[.]com, banknotesssdchemicalsolution[.]com) are on other FranTech addresses; they are leads on the same hosting network, nothing more.

D. Four research-chemical shops on one PureVoltage address (4 sites)

Evidence class: shared hosting IP, name servers and registrar. Grade: infrastructure only; ownership unresolved.

mollynl[.]com ("pure MDMA from the Netherlands"), buyrc[.]org, chemsocean[.]com and jeffbenzos[.]net resolve to 66.23.195.156 with the name servers ns1/ns2.steadyturtle.com and NameSilo registrations dated 2019 to 2023. urlscan.io shows twenty other hostnames on that address in the same window, including a restaurant, a dental practice and a run of marketing-agency placeholders, so this is shared hosting. The four shops share a subject and a stack; that is where the evidence stops.

E. A psychedelics shop that loads another shop's assets (4 sites)

Evidence class: cross-domain asset loading for one pair; hosting and mail overlap for the rest. Grade: medium for the pair, low for the rest.

annarborpsychedelicsshop[.]com ("Where to buy DMT in Michigan", registered June 2026) requests page assets from psychedelicstore[.]eu (01a159d6…). That can mean copying, hotlinking, shared development or shared management. psychedelicstore.eu and psychedelicsdispensary[.]net share SiteGround hosting and the same anti-spam mail cluster as dmt-vapes[.]com, which is a weaker, service-level overlap.

F. Link-ring drug and counterfeit shops (7 corpus sites linking about 30 more)

Evidence class: footer cross-links. Grade: linking behaviour, not ownership.

dtradeempire[.]com's footer links twenty sibling shops (01a159d7…): cocaineforsale[.]co, methcrystals[.]com, fentvendor[.]com, euthanasianembutal[.]com, crystalmethbuy[.]com, cocainesupplier[.]com and others. gardenweeddispensary[.]com links counterfeit-money and clone-card shops (01a159d8…). counterfeitguru[.]com links ketamineguru[.]com, bluepearlpharmacy[.]com and unitedgunshopusa[.]com (01a159d7…). mandspyschedelics[.]com prints a Gmail inbox and a US WhatsApp number and names Zelle and Cash App; buycolombiancoke[.]com's page title in ScamMinder's 13 October 2026 capture read "Buy crack online, $25 per gram" (the 20 October scan rendered only a verification page); oceantranslogisticcargo[.]com uses a logistics-themed domain name, while the inspected capture displays an MDMA storefront; its earlier use has not been established. Two registrants in this set declared Cameroon. This is the profile that consumer-protection reporting has long associated with advance-fee drug shops that take a first payment and then invent a customs or insurance fee. We hold no victim reports or payment records for these specific sites, so non-delivery is an assessment from the pattern, not a finding.

G. The Russian diploma candidate family (274 registrable domains from a title-phrase search)

Evidence class: a diploma-purchase title phrase, a hosting pattern and a naming pattern. Grade: candidate family; one origin-IP cluster of 8 verified.

ru-diplomirovanie[.]com is the corpus member. When we submitted it on 20 October the browser was redirected off-domain to rudiplomir.com (01a159da…), so the storefront, the origin address 185.74.254.106 (WIBO Baltic UAB) and the contact details below belong to that destination. The rendered page prints three numbers, +7 901 397-07-15, +7 916 105-50-49 and 8 800 301-76-90, and the inbox 1000diploms@gmail.com; ScamMinder's July 2026 capture of ru-diplomirovanie.com itself recorded the 8 800 number and the same inbox. urlscan.io's page.ip search for the destination address returned seven more rudik*-diplom* hostnames.

The wider family is a candidate set, not a title match: the search page.title:"купить диплом" is a phrase search for "buy a diploma", and the pages it returns carry many different titles. Retrieved on 20 October 2026 it gave 407 scans, 274 distinct hostnames and 274 registrable domains dated 22 July to 20 October; 211 of the hostnames were served from WIBO Baltic, 24 from HOSTKEY and 16 from velia.net, with names like russb-diplomq.ru, goznakc-diplomo.online and express-diplomiq.lol. A narrower search requiring ГОЗНАК in the title as well returned 196 scans and 118 registrable domains. Many results showed the FASTPANEL hosting panel at scan time, which is a common control panel, not an operator fingerprint. A sister phrase search for Russian driving licences ("купить права") returned 33 registrable domains on Podaon, Fornex and DDoS-Guard. Whether these sites deliver forged documents or simply take payment is not something we tested; ScamMinder files them under counterfeit documents on the basis of what they advertise. The scan ids and the deduplicated member list for each search are retained with the research records; the member list for the phrase search is published in the appendix.

H. The Authorize-related carding title and naming family (27 registrable domains)

Evidence class: a shared title phrase and naming pattern; the exact title on 17. Grade: candidate family, template not compared.

authorizecvv[.]io, authorizecvv[.]pro and authorizedcvvdumps[.]mp are the members ScamMinder has rated. Our rule for the family was: a hostname in the urlscan.io results for page.title:"fullz" or page.title:"cvv shop" whose title or hostname contains "authorize", "authorise" or "authorlze". That gives 35 hostnames and 27 registrable domains (www variants merged); the exact title "Cvv Authorize Shop | Fullz High Credit Score" alone covers 19 hostnames and 17 registrable domains. 23 of the hostnames sit behind Cloudflare and 7 on Hostinger. Only the 17 exact-title domains can be called the same storefront title; the other 10 match on naming and a title phrase, and no layout, code or asset comparison was made. Whether one seller or a resold panel is behind them is not established.

I. Sites using the SSNDOB name (8 domains)

Evidence class: brand name and one page design; shared hosting for two. Grade: brand-use group.

ssndob[.]shop, ssndob[.]pw, ssndob[.]me, ssndob[.]io, ssndob[.]pro, ssndob[.]uk, ssndob[.]cx and ssn24[.]top all claim to sell US Social Security numbers and dates of birth. The two with visible origins share ExpressHost (Netherlands), Tencent DNSPod name servers and NICENIC registrations on the same day in September 2023. The original SSNDOB marketplace domains were seized by US authorities on 7 June 2022; the relationship of these later sites to that marketplace is unverified.

J. Russian-hosted CVV shops (10 sites, lead only)

Evidence class: subject, .su/.ru domains, common DNS providers. Grade: unvalidated lead.

cvv-net[.]su (RocketCloud), cvv-shop[.]su (Global Internet Solutions), cvv2[.]su, cvv4you[.]su (VNPT, Vietnam), pawn-shop[.]cc (Beltelecom, registered 2018), cardingshop[.]ru and cardingclub[.]ru share a subject, Soviet-era and Russian TLDs and the alidns or internetget.su name servers. Several appeared in one week in late May 2026, the spike in Figure 2. That is enough to group them for monitoring and not enough to call them one network.

K. The .mp carding wave, September 2024 to April 2025 (13 hostnames)

Evidence class: shared Telegram support account on three; same registration wave and page design on the rest. Grade: high for the three, medium for the wave.

Between 3 September 2024 and 2 April 2025 thirteen carding hostnames reached ScamMinder as one wave: ten on the Northern Mariana Islands TLD (nine registrable .mp domains, two of them as fullz. subdomains), plus marketcvv[.]shop with its topcc. subdomain and eracvv[.]me; nine of the thirteen arrived in October 2024 alone. Members include primecvv[.]mp, eracvvs[.]mp, fullz[.]bestcvvshop[.]mp, fullz[.]validccshops[.]mp, liveccvv[.]mp, livecvvdumpshop[.]mp, livecvvdumps[.]mp, cvvfullzshop[.]mp and bclubcvv[.]mp. fullz.bestcvvshop.mp, fullz.validccshops.mp and validccshops[.]mp advertised the same Telegram support account in ScamMinder's captures. fullz.validccshops.mp also listed the same five card BIN prefixes as marketcvv.shop, which may be copied inventory or a common upstream rather than one seller. Unit of the count: hostnames as ScamMinder recorded them.

L. Darknet mirror and gateway candidates (289 registrable domains)

Evidence class: templated "official onion links" titles. Grade: candidate set; phishing behaviour not tested.

nexusmirror[.]org, darknet[.]nexusofficial[.]link and nexusonion[.]digital are "verified mirror" pages for the Nexus darknet market. A title search for "onion links" returned 393 scans, 103 hostnames and 101 registrable domains covering Nexus (30), DrugHub (19), Torzon (16), DarkMatter (14) and BlackOps (6), 94 of them on Cloudflare, on throwaway TLDs (.sbs, .digital, .cyou, .icu, .cfd). A Russian-language search for "Кракен" returned 818 scans and 452 hostnames; after removing titles about the film, a casino, electronics and furniture shops, a charity and an investment firm (169 hostnames), 283 hostnames and 188 registrable domains remain that describe themselves as links, mirrors or entrances to the Kraken darknet marketplace, 252 of the hostnames on Cloudflare. These pages advertise access to darknet markets, but this investigation did not verify the destinations or test them for credential capture or payment redirection; the inclusion rule is the title alone. The 188-domain member list is published in the appendix with the observed hostname, URL and scan id for every row, because a domain is only an aggregation key: publisher[.]acm[.]permanyer[.]com/documents/kraken/ is one Kraken-themed page under an unrelated parent domain, and the d2web[.]link entry is one content-specific IPFS gateway hostname; neither observation says anything about the parent domain's operator. Some members may be compromised pages or hosted content rather than dedicated gateway domains, and ownership is unresolved for all of them and the excluded titles are retained with the research records.

Infrastructure and geography

Of the 173 corpus records, 121 still resolved when ScamMinder last captured them (unit: corpus records, so a path record and its root count separately). Sixty-nine sit behind Cloudflare, which hides the origin. Where the origin is visible, Hostinger shared hosting (servers in the US, Germany and Lithuania) is the most common home for drug shops; Hostinger mail appears on 11 records and the Titan mail service, which Hostinger distributes, on 4. The dedicated hosts recur: FranTech/BuyVM (Luxembourg) for cluster C, Virtual Systems LLC in Kyiv for idgod.ph and for cocaine and psychedelics shops urlscan.io found on the same network, Omegatech for idgod.com and bogusbraxtor.com, PureVoltage for cluster D, SpectraIP (Netherlands) for gradepharma[.]com beside more than two hundred other hostnames on the same address, many of them fake banks and CFD brokers, WIBO Baltic and HOSTKEY for the diploma family, and ExpressHost for two SSNDOB sites. Naming a provider describes where a site was served from at capture time; it is not a claim that the provider knew of the content.

Registrars: NICENIC (Hong Kong) 16, NameSilo 13, Registrar.eu 6, Internet Domain Service BS 5. Registrant countries, where WHOIS shows one, are the United States (19, mostly privacy proxies), the Netherlands, China, the Bahamas and Cameroon; a registrant country is a form field, not a location. Top-level domains are led by .com (67), then .cc (17), .mp (10), .su (7), .shop (6) and .ru (5); the Philippine .ph recurs across the fake-ID groups in cluster A.

Target markets are visible in the copy: US state licences and US students for the fake-ID shops; Canada, the UK, Australia, France and Dubai for the "delivery" drug names; Russia for the diploma and driving-licence families; and US cardholders for the carding and SSN shops.

Status of the 71 casework hosts on 20 October 2026

"Live" hides several different observations, so each one is listed per host. Of 71 hosts, 13 did not resolve and 3 are Tor gateways urlscan.io refuses, so 55 submissions were accepted. 51 produced a retrievable result record; 49 of those recorded an HTTP status and a DOM; the two records without a status or DOM (fakeid[.]pm, undetectedbanknotes[.]com) are counted as nothing more than "a record exists". Of the 49 rendered pages, 35 showed an illicit-goods storefront, 4 showed other content (a hosting provider, a consumer shop, a review site and a filler blog), 4 showed a human-verification or challenge page, 1 a default server page, 2 an expired-domain parking page and 3 an error response. One submission was redirected off-domain and is marked. A rendered storefront does not establish that orders are fulfilled, and a page that did not render tells us nothing about the shop that ScamMinder captured on an earlier date.

Submitted host	Scan	Observed (UTC)	HTTP status	DOM	Rendered content on 20 October 2026
acheterbonnedrogues[.]com	—			no	DNS resolution failed
annarborpsychedelicsshop[.]com	01a159d6…	2026-10-20 15:03 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
barcodes[.]fakeidsolutions[.]com	01a159d6…	2026-10-20 15:03 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
bestmarketplaces[.]site	—			no	DNS resolution failed
buycocaineonlinecanada[.]com	01a159d6…	2026-10-20 15:03 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
buycolombiancoke[.]com	01a159d6…	2026-10-20 15:03 UTC	HTTP 200	yes	Challenge page (cPGuard / ALTCHA "Security Check Required"); storefront not rendered
chemspowder[.]com	01a159d6…	2026-10-20 15:03 UTC	HTTP 403	yes	Challenge page (Cloudflare, HTTP 403)
counterfeitguru[.]com	01a159d7…	2026-10-20 15:03 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
cvvcard[.]lv	—			no	DNS resolution failed
cvvmarket[.]cc	01a159d7…	2026-10-20 15:04 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
cvvmarket[.]store	—			no	DNS resolution failed
darknet[.]nexusofficial[.]link	—			no	DNS resolution failed
distrodelsanto[.]com	01a159d7…	2026-10-20 15:04 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
dmt-vapes[.]com	01a159d7…	2026-10-20 15:04 UTC	HTTP 403	yes	Challenge page (Cloudflare, HTTP 403)
dmtvapesonline[.]com	01a159d7…	2026-10-20 15:04 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
drunkid[.]com	01a159d7…	2026-10-20 15:04 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
dryspringspharmacy[.]net	—			no	DNS resolution failed
dtradeempire[.]com	01a159d7…	2026-10-20 15:04 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
eltrappo[.]co[.]uk	—			no	DNS resolution failed
evolvedids[.]com	01a159d7…	2026-10-20 15:04 UTC	HTTP 403	yes	Challenge page (Cloudflare, HTTP 403)
exchanicao7q33lwszfpl3s4fmaufj3jvaahp4nplm6banflznusbgid[.]onion[.]ly	—			no	Submission rejected by urlscan.io (Tor gateway)
exoticdispensaries[.]com	01a159d7…	2026-10-20 15:04 UTC	HTTP 200	yes	Other content: filler blog text; the storefront in ScamMinder's January 2026 capture was not rendered
fakeid[.]pm	01a159d7…	2026-10-20 15:05 UTC		no	Result record without HTTP status or DOM
fakeidworld[.]com	01a159d7…	2026-10-20 15:04 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
fakeyourdrank[.]com	01a159d7…			no	Accepted; no result record retrievable
fullzmarketplace[.]com	—			no	DNS resolution failed
gardenweeddispensary[.]com	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
ghsplean[.]com	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
gradepharma[.]com	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
hochtrippig[.]at	—			no	DNS resolution failed
huntbay-chemicals[.]com	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Expired-domain parking page
idbook[.]ph	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
idgod[.]com	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
idgod[.]ph	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
idlord[.]com	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
idpapa[.]com	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
idpark[.]cc	—			no	DNS resolution failed
idpimp[.]ph	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
idtop[.]is	01a159d8…			no	Accepted; no result record retrievable
idtop[.]ph	01a159d8…	2026-10-20 15:05 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
legitcarders[.]ws	—			no	DNS resolution failed
litfakes[.]com	01a159d8…	2026-10-20 15:06 UTC	HTTP 400	yes	Error response (HTTP 400 "Invalid URL")
lsdeu[.]com	01a159d9…	2026-10-20 15:06 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
mandspyschedelics[.]com	01a159d9…	2026-10-20 15:06 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
mdmacanada[.]cc	01a159d9…	2026-10-20 15:06 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
mydarkreviews[.]com	01a159d9…	2026-10-20 15:06 UTC	HTTP 200	yes	Other content: carding review and directory site, not a seller
myexpressdoc24[.]com	01a159d9…	2026-10-20 15:06 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
myfakeid[.]biz	01a159d9…	2026-10-20 15:08 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
mynymbox[.]io	01a159d9…	2026-10-20 15:06 UTC	HTTP 200	yes	Other content: hosting and domain provider; infrastructure lead, excluded from all statistics
myoro[.]co	01a159d9…	2026-10-20 15:07 UTC	HTTP 200	yes	Other content: consumer sexual-health shop; removed from the study population
newcareonlinepharmac[.]com	01a159d9…			no	Accepted; no result record retrievable
nexusmirror[.]org	—			no	DNS resolution failed
oceantranslogisticcargo[.]com	01a159d9…	2026-10-20 15:06 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
onion[.]ly	—			no	Submission rejected by urlscan.io (Tor gateway)
onion[.]to	01a159d9…			no	Accepted; no result record retrievable
online-ph[.]com	01a159d9…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
onlinepsychedelicsmarket[.]com	01a159d9…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
opioidsmeds[.]com	—			no	DNS resolution failed
pharmasource1[.]com	01a159da…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
portentis[.]com	01a159da…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
powderhemisphere[.]com	01a159da…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
premiumcocainestore[.]com	01a159da…	2026-10-20 15:07 UTC	HTTP 403	yes	Default server page (AlmaLinux test page, HTTP 403)
ru-diplomirovanie[.]com	01a159da…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered → rudiplomir[.]com
santacvv[.]shop	01a159da…	2026-10-20 15:07 UTC	HTTP 522	yes	Error response (Cloudflare 522)
scannablefakeid[.]eu	01a159da…	2026-10-20 15:07 UTC	HTTP 500	yes	Error response (HTTP 500 "Database Error")
starcvv[.]at	01a159da…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
stormer5v52vjsw66jmds7ndeecudq444woadhzr2plxlaayexnh6eqd[.]onion[.]ly	—			no	Submission rejected by urlscan.io (Tor gateway)
toseina[.]com	01a159da…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
trustedbillsandclones[.]com	01a159da…	2026-10-20 15:07 UTC	HTTP 200	yes	Illicit-goods storefront content rendered
undetectedbanknotes[.]com	01a159da…	2026-10-20 15:08 UTC		no	Result record without HTTP status or DOM
variablebills[.]com	01a159da…	2026-10-20 15:07 UTC	HTTP 200	yes	Expired-domain parking page (ParkLogic)

How the storefronts say they get paid and reached

The population is the 35 pages that rendered an illicit-goods storefront on 20 October (not all 49 rendered pages: the hosting provider, the consumer shop, the review site and the filler blog are excluded, as are challenge, parked and error pages). On those 35, 25 run WordPress and 25 WooCommerce. A payment method or service is named when it appears in the visible text (scripts, styles and encoded images removed) and stated as accepted when the sentence says the seller takes it; an instruction to buy cryptocurrency or gift codes elsewhere is an indirect funding route and a negative sentence ("no PayPal") is a mention only. Every row was classified by hand from the supporting sentence, published in the appendix. Bitcoin: 21 named, 19 stated as accepted. PayPal: 4 named, 0 stated as accepted: idbook[.]ph tells buyers to purchase Razer Gold codes with PayPal from a third party; drunkid[.]com's homepage only links a page titled "How to Pay with PayPal", which was outside our scan and which, when the reviewer fetched it, says PayPal is not accepted directly and explains buying Bitcoin with it; dtradeempire[.]com and starcvv[.]at name it in keyword lists. The measurement covers the rendered homepage only; a navigation-link title is recorded as an unverified instruction link, never as acceptance, which is also why drunkid.com's "How to Pay with Gift Cards" link counts as a mention. Gift cards or game codes: 4 named, 3 stated as accepted. USDT: 3 named, 3 stated as accepted. Cash App: 2 named, 1 stated as accepted. Apple Pay, Google Pay, Monero, Zelle, Ethereum, Interac e-transfer and credit cards are each named and stated as accepted by one storefront; Coinbase is named once as a wallet to send Bitcoin from. A named service is never evidence that the service knowingly serves the seller, and no checkout integration was observed; "stated as accepted" is the seller's claim. On the same 35 pages, 16 print an email address, 12 link a Telegram account, 8 a WhatsApp number and 1 a Signal group. No page printed a Bitcoin address that passed checksum validation.

Tactics we saw repeatedly

• Brand squatting inside the trade. "IDGod", "SSNDOB", "AlphaBay", "Russian Market", "UltimateShop" and "Nexus" are names of past or current criminal services; sites reuse them to catch buyers searching for the original.
• City-and-country domain spraying. buycocaineonlinedubai, buyweedonlineinbudapest, buyweedonlineinmauritius, cocaineinlondon: one naming pattern, one domain per search phrase, mostly on Hostinger. Whether they share a template was not tested.
• Review and directory sites inside the ecosystem. fakeidvendors[.]net is linked from idtop.ph and mydarkreviews[.]com reviews "trusted" fullz shops. Who runs them, and whether listings are paid, is not established.
• Legitimate-looking trust signals. PayPal wording, "lab-tested", "100% delivery guaranteed", review widgets and live-chat plugins (Smartsupp, Crisp) on pages selling controlled substances.
• Domain names that read as another business. oceantranslogisticcargo.com sells MDMA and escort-alligator.com cannabis. We hold no dated capture of either name in an earlier use, so whether they were repurposed or chosen for the look is unknown.
• Automation and anti-detect tooling, observed once. drunkid[.]com loads resources from fingerprints.bablosoft.com and customfingerprints.bablosoft.com, a browser-fingerprint service used with Browser Automation Studio (01a159d7…). That is an observation; what the operator uses it for is an inference we could confirm only by capturing the page's own scripts or order flow.
• Control panels and hosting leftovers. FASTPANEL, "Account Suspended", "Test Page for the HTTP Server on AlmaLinux" and Cloudflare 521 pages appeared on domains in these families at scan time. A single scan shows the state of that moment, not how often it changes.

What this means for you

1. These sites advertise illegal goods. Selling or buying forged identity documents, controlled substances, stolen card data or counterfeit currency is a criminal offence in most jurisdictions, whatever a site says about "novelty" use. A ScamMinder score describes trust and safety signals; it can never make such a purchase safe.
2. Suspected buyer fraud. The link-ring shops in cluster F match the advance-fee pattern: a first payment in cryptocurrency, Zelle, Cash App or gift codes, then a demand for a "customs" or "insurance" fee. We have not verified non-delivery for a named site; treat it as the likely outcome, not a proven one.
3. Carding and SSN shops sell data whose use is a felony, and many such shops are reported to take payment and deliver dead data or nothing. Their "valid rate" promises and Telegram support channels are the lure.
4. Unverified gateways. Clear-web pages offering "verified onion links" for a darknet market advertise access to those markets; this investigation did not verify the destinations or test the pages for credential capture or payment redirection. Treat any such page as an unresolved risk.
5. If you already paid or shared information: keep every message, receipt and transaction id; contact the payment provider or exchange at once and ask about reversal or a freeze; change any password you reused; and report through your national channel (IC3 in the United States; Report Fraud at reportfraud.police.uk for England, Wales and Northern Ireland, Police Scotland in Scotland; the Canadian Anti-Fraud Centre; or your own police cybercrime portal).
6. Defenders and providers. The indicators below are grouped by evidence class so that a single Telegram account, analytics tenant or origin address can be used to find the rest of a group. ScamMinder's casework queue holds abuse and law-enforcement report packets for these sites.
7. Check a link before you trust it. Paste it into ScamMinder to see what the site is and what evidence sits behind its score. A score describes trust and safety signals; it does not make buying advertised illicit goods safe or legal. Every indicator below that ScamMinder has analysed links to its full report.

Indicators of compromise

Domains are defanged (for example example[.]com) so they cannot be opened by accident. Indicators ScamMinder has analysed link to the report for that site, never to the site itself. Indicators seen only in urlscan.io, or only as a link target, are shown in grey without a score; where a table is marked "sample" it lists part of a larger family and the full list is published or retained as stated. Extraction false positives from the first version (four wallet-like strings) have been removed.

Operator identifiers and shared infrastructure

Each row says how many pages carry the identifier and what that proves. Phone numbers are printed as the sites print them.

Type	Indicator	Seen on	Relationship
Telegram	idgodphfakeidscom	idgod.ph, idpimp.ph (both also print WhatsApp +1 601 658 0419)	exact match on two pages
Telegram	idzone_Discount	idtop.ph only	similar naming to idbook_Discount; not a shared identifier
Telegram	idbook_Discount	idbook.ph only	similar naming to idzone_Discount; not a shared identifier
Telegram	idlord_support	idlord.com (WhatsApp +1 213 522 1610)	single site
Telegram	idpapacs	idpapa.com (WhatsApp +1 347 245 1276)	single site
Telegram	fidssupportbot	barcodes.fakeidsolutions.com	single site
Telegram	fantasma070	distrodelsanto.com (WhatsApp +61 468 245 067)	single site
Telegram	MXYOG	ghsplean.com	single site
Telegram	bulkweedbc	mdmacanada.cc	single site
Telegram	trustedbillsandclones	trustedbillsandclones.com (WhatsApp +44 7830 705382, Signal group link)	single site
Analytics tenant (Matomo Cloud)	yoloids.matomo.cloud	idlord.com, idpapa.com	exact match on two pages
Tracking host	an.kingdream.vip	idlord.com, idpapa.com	exact match on two pages
Analytics host	analytics.pugos.cn	idtop.ph	single site
Third-party resource	fingerprints.bablosoft.com, customfingerprints.bablosoft.com	drunkid.com	observation; purpose not established
Mail provider	mxw/mxn.mxhichina.com (Alibaba enterprise mail)	idlord.com, idpapa.com	shared service, context only
Mail provider	hzmx01/02.mxmail.netease.com	idbook.ph	context only
Mail provider	mxbiz1/2.qq.com + f1g1ns1/2.dnspod.net	idtop.ph	context only
Origin IP	198.251.84.129 (AS53667 FranTech / BuyVM, LU)	distrodelsanto.com, mdmadelivery.co.uk, mdmadelivery.ca, ukcocainedelivery.com, cocainedelivery.ca, alphamms.co	shared host; also serves unrelated fraud
Origin IP	66.23.195.156 (AS398395 PureVoltage) + ns1/ns2.steadyturtle.com	mollynl.com, buyrc.org, chemsocean.com, jeffbenzos.net	shared hosting; unrelated sites on the same IP
Origin IP	91.208.115.38 (AS30860 Virtual Systems, Kyiv) + pns11/12.stop-ddos.net	idgod.ph	single site
Origin IP	94.154.35.248 (AS202412 Omegatech)	idgod.com	single site; bogusbraxtor.com on the same network
Origin IP	185.74.254.106 (AS59939 WIBO Baltic)	ru-diplomirovanie.com + 7 rudik*-diplom* hostnames	shared host
Origin IP	154.86.119.99 / .231 (AS197574 ExpressHost) + a/c.dnspod.com	ssndob.io, ssndob.pw	shared host
Contact inbox	distrodelsanto@proton.me	distrodelsanto.com	single site
Contact inbox	dtradeempire@gmail.com	dtradeempire.com	single site
Contact inbox	mspsychedelics023@gmail.com	mandspyschedelics.com	single site
Contact inbox	1000diploms@gmail.com; +7 800 301 7690	ru-diplomirovanie.com	single site
Contact inbox	idtopids@protonmail.com	idtop.is	single site

A. Fake-ID shops with shared operator identifiers (9)

Evidence per row; a verified row rests on a scan, a ledger row on a 2024 ScamMinder capture, a lead or candidate on a link or a name.

Indicator	ScamMinder trust score	Evidence
idlord[.]com	10/100 (scam)	A1 verified: requests yoloids.matomo.cloud + an.kingdream.vip
idpapa[.]com	10/100 (scam)	A1 verified: requests yoloids.matomo.cloud + an.kingdream.vip
yoloids[.]com	20/100 (scam)	A1 candidate: the shared Matomo tenant is named "yoloids"; site not scanned, ownership unverified
idlord[.]ph	linked from a scanned page; destination not scanned	A1 lead: linked from a scanned page (idlord.com); destination not scanned
idgod[.]ph	12/100 (scam)	A2 verified: Telegram idgodphfakeidscom + WhatsApp +1 601 658 0419
idpimp[.]ph	10/100 (scam)	A2 verified: Telegram idgodphfakeidscom + WhatsApp +1 601 658 0419
idgod[.]com[.]ph	0/100 (scam)	A2 ledger: shared inbox idgod@idgod.ph in 2024 captures; dead
idpark[.]cc	10/100 (inactive)	A3 ledger: one Telegram handle in 2024 captures; dead
idpark[.]ph	10/100 (scam)	A3 ledger: one Telegram handle in 2024 captures; dead

A, leads only: similar naming, shared template or Chinese mail providers (5)

Evidence class: template family and naming; no shared identifier.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
idtop[.]ph	10/100 (scam)
idbook[.]ph	10/100 (scam)
idtop[.]is	12/100 (scam)
scannablefakeid[.]eu	10/100 (scam)
fakeid[.]pm	12/100 (scam)

B. "IDGod" brand-use group and other fake-ID shops (29)

Evidence class: brand name; the counterfeit-documents detector; urlscan.io title search.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
idgod[.]com	12/100 (scam)
idgod[.]ph	12/100 (scam)
bogusbraxtor[.]com	10/100 (scam)
idgodfakeids[.]com	urlscan.io only, not analysed
idgod[.]shop	urlscan.io only, not analysed
buyfakeidonline[.]cc	urlscan.io only, not analysed
drunkid[.]com	10/100 (scam)
fakeyourdrank[.]com	12/100 (scam)
evolvedids[.]com	50/100 (warning)
barcodes[.]fakeidsolutions[.]com	40/100 (warning)
myfakeid[.]biz	10/100 (scam)
fakeidworld[.]com	10/100 (scam)
kingfakeid[.]com	10/100 (warning)
fakeidinuk[.]co[.]uk	40/100 (warning)
irishfakeid[.]com	10/100 (scam)
bbfake[.]ph	40/100 (warning)
idrocket[.]biz	urlscan.io only, not analysed
idrocket[.]org	urlscan.io only, not analysed
idrockets[.]ph	urlscan.io only, not analysed
idsky[.]ph	urlscan.io only, not analysed
usaidl[.]top	urlscan.io only, not analysed
noveltyalliance[.]biz	urlscan.io only, not analysed
magicfakes[.]pw	urlscan.io only, not analysed
oldironsidesfakesph[.]com	urlscan.io only, not analysed
id-fake[.]com	urlscan.io only, not analysed
fakiess[.]com	urlscan.io only, not analysed
club21idsofficial[.]com	urlscan.io only, not analysed
usabestfakeid[.]com	urlscan.io only, not analysed
editablepsd[.]xyz	urlscan.io only, not analysed

Fake documents, passports and diplomas (English-language) (17)

Evidence class: counterfeit-documents detector and urlscan.io title search.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
myexpressdoc24[.]com	12/100 (scam)
fkdocuments[.]com	12/100 (scam)
fastdocuments[.]co[.]uk	40/100 (warning)
scan-lab[.]net	10/100 (warning)
onlyfake[.]ru	20/100 (warning)
idman[.]pro	20/100 (warning)
legitglobaldocuments[.]com	urlscan.io only, not analysed
qualitycounterfeitbanknotes[.]com	urlscan.io only, not analysed
sominxdocuments[.]net	urlscan.io only, not analysed
veritasdocagency[.]com	urlscan.io only, not analysed
myglobaldocument[.]com	urlscan.io only, not analysed
pacificdocumentagency[.]com	urlscan.io only, not analysed
eudocumentpro[.]com	urlscan.io only, not analysed
pcfdocuments[.]com	urlscan.io only, not analysed
qiuckdocservice[.]com	urlscan.io only, not analysed
authenticdocsagency[.]com	urlscan.io only, not analysed
veriftool[.]fun	urlscan.io only, not analysed

C. Shops on the FranTech origin address 198.251.84.129 (6)

Evidence class: shared origin IP (urlscan.io page.ip search).

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
distrodelsanto[.]com	40/100 (warning)
mdmadelivery[.]co[.]uk	urlscan.io only, not analysed
mdmadelivery[.]ca	urlscan.io only, not analysed
ukcocainedelivery[.]com	urlscan.io only, not analysed
cocainedelivery[.]ca	urlscan.io only, not analysed
alphamms[.]co	urlscan.io only, not analysed

C, leads only: other FranTech (AS53667) addresses (10)

Evidence class: same hosting network, different IP.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
buycocaineonlinedubai[.]com	urlscan.io only, not analysed
cnento[.]com	urlscan.io only, not analysed
psychedelicbird[.]com	urlscan.io only, not analysed
buyshrooms[.]ca	urlscan.io only, not analysed
billsbuffbanknotes[.]com	urlscan.io only, not analysed
undetectablepropandcounterfeit[.]net	urlscan.io only, not analysed
authenticdocsagency[.]com	urlscan.io only, not analysed
oakslog[.]com	urlscan.io only, not analysed
mindfoodshop[.]com	urlscan.io only, not analysed
banknotesssdchemicalsolution[.]com	urlscan.io only, not analysed

D. Research-chemical shops on 66.23.195.156 (4)

Evidence class: shared hosting IP, name servers and registrar.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
mollynl[.]com	20/100 (scam)
buyrc[.]org	50/100 (warning)
chemsocean[.]com	55/100 (warning)
jeffbenzos[.]net	55/100 (warning)

E. Psychedelics asset-sharing cluster (4)

Evidence class: cross-domain asset loading (first pair); hosting and mail overlap.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
annarborpsychedelicsshop[.]com	10/100 (scam)
psychedelicstore[.]eu	39/100 (scam)
psychedelicsdispensary[.]net	50/100 (warning)
dmt-vapes[.]com	55/100 (warning)

F. Link-ring shops, corpus members (7)

Evidence class: footer cross-links.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
dtradeempire[.]com	10/100 (scam)
gardenweeddispensary[.]com	55/100 (warning)
counterfeitguru[.]com	12/100 (scam)
mandspyschedelics[.]com	55/100 (warning)
buycolombiancoke[.]com	40/100 (warning)
oceantranslogisticcargo[.]com	25/100 (warning)
trustedbillsandclones[.]com	12/100 (scam)

F. Link-ring shops, linked targets (31)

Evidence class: linked from dtradeempire.com, gardenweeddispensary.com or counterfeitguru.com.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
distrodelsanto[.]com	40/100 (warning)
cocaineforsale[.]co	urlscan.io only, not analysed
cocainelovers[.]com	urlscan.io only, not analysed
powderchemicals[.]com	urlscan.io only, not analysed
methcrystals[.]com	urlscan.io only, not analysed
alphacannabisdispensary[.]com	urlscan.io only, not analysed
clinicalresearchchemicals[.]com	urlscan.io only, not analysed
kokapartyinc[.]io	urlscan.io only, not analysed
cocainesupplier[.]com	urlscan.io only, not analysed
cadulacchemicalsltd[.]com	urlscan.io only, not analysed
euthanasianembutal[.]com	urlscan.io only, not analysed
medikininc[.]com	urlscan.io only, not analysed
fentvendor[.]com	urlscan.io only, not analysed
crystalmethsuppliers[.]com	urlscan.io only, not analysed
pharmaceuticalpowders[.]com	urlscan.io only, not analysed
crystalmethbuy[.]com	0/100 (scam)
thcvapeworldwideshop[.]com	urlscan.io only, not analysed
nationwidevapes[.]com	urlscan.io only, not analysed
ultimatecounterfeit[.]com	urlscan.io only, not analysed
counterfeitfutures[.]com	urlscan.io only, not analysed
cashcounternotes[.]com	urlscan.io only, not analysed
getcardsclones[.]com	urlscan.io only, not analysed
k2labsspray[.]com	urlscan.io only, not analysed
counterfeitmoneycity[.]com	urlscan.io only, not analysed
uniquecounterfeit[.]com	urlscan.io only, not analysed
buycounterfeitmoney[.]com	urlscan.io only, not analysed
ketamineguru[.]com	urlscan.io only, not analysed
bluepearlpharmacy[.]com	urlscan.io only, not analysed
unitedgunshopusa[.]com	urlscan.io only, not analysed
boombars[.]us[.]com	10/100 (scam)
jungleboysstrains[.]com	urlscan.io only, not analysed

Other drug and pharmacy shops (55)

Evidence class: illicit-goods detector and urlscan.io title search.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
buycocaineonlinecanada[.]com	10/100 (scam)
buycocaineonlineincanada[.]io	10/100 (scam)
buyingcocaineonlinecanada[.]com	10/100 (scam)
streetcocaineshop[.]com	10/100 (scam)
premiumcocainestore[.]com	0/100 (scam)
powderhemisphere[.]com	40/100 (warning)
lsdeu[.]com	0/100 (scam)
mdmacanada[.]cc	10/100 (scam)
mollycanada[.]se	20/100 (scam)
canadadmtsupplies[.]com	20/100 (scam)
dmtvapesonline[.]com	50/100 (unknown)
dmtdeliveryusa[.]com	10/100 (scam)
ultratrips[.]ca	20/100 (scam)
mytrippy[.]ca	55/100 (warning)
buyketacanada[.]se	55/100 (warning)
canadabloom[.]se	45/100 (warning)
psychedelic-today[.]com	55/100 (warning)
psychedelicsplanet[.]com	20/100 (scam)
globaldispendsary[.]com	15/100 (scam)
medibopsychedelics[.]com	20/100 (warning)
onlinepsychedelicsmarket[.]com	10/100 (scam)
exoticdispensaries[.]com	20/100 (scam)
heroindistro[.]com	40/100 (warning)
trippyspace[.]eu	40/100 (warning)
psydera[.]eu	10/100 (scam)
chemspowder[.]com	60/100 (warning)
toseina[.]com	55/100 (warning)
oxydolor[.]com	10/100 (scam)
ghsplean[.]com	55/100 (warning)
gradepharma[.]com	55/100 (warning)
pharmasource1[.]com	40/100 (warning)
portentis[.]com	55/100 (warning)
online-ph[.]com	55/100 (warning)
newcareonlinepharmac[.]com	55/100 (warning)
huntbay-chemicals[.]com	20/100 (inactive)
hochtrippig[.]at	50/100 (inactive)
acheterbonnedrogues[.]com	10/100 (inactive)
cocainemap[.]org	40/100 (warning)
discreetcocainedelivery[.]com	urlscan.io only, not analysed
worldwidecocainedelivery[.]com	urlscan.io only, not analysed
buycocaine[.]shop	urlscan.io only, not analysed
buycocainedelivery[.]shop	urlscan.io only, not analysed
cocaine-center[.]com	urlscan.io only, not analysed
cocaineplug[.]org	urlscan.io only, not analysed
cocaineshoponline[.]com	urlscan.io only, not analysed
buycocaineonlineinfrance[.]com	urlscan.io only, not analysed
buycocaineonlineinaustria[.]io	urlscan.io only, not analysed
cracksnowfrance[.]com	urlscan.io only, not analysed
melbourneprocedurestore[.]com	urlscan.io only, not analysed
buyperuvianonline[.]com	urlscan.io only, not analysed
buybolivianconline[.]com	urlscan.io only, not analysed
psychedelicsstore[.]uk	urlscan.io only, not analysed
dmtdelivery[.]ca	urlscan.io only, not analysed
ghostlinedrops[.]com	urlscan.io only, not analysed
psychedeliapulse[.]com	urlscan.io only, not analysed

Excluded after review (1)

Listed for the audit trail only; not part of the study population or any total.

Indicator	ScamMinder trust score	Reason
myoro[.]co	60/100 (warning)	rendered page on 20 October sells consumer sexual-health devices; the illicit-goods case rests on an earlier capture and the record was removed from this study

G. Russian diploma candidate family (27 (sample))

Evidence class: title-phrase search "купить диплом"; the first eight hostnames share the origin IP 185.74.254.106 with the rudiplomir.com storefront.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
ru-diplomirovanie[.]com	52/100 (unknown)
rudika-diploms[.]online	urlscan.io only, not analysed
rudiku-diplomg[.]online	urlscan.io only, not analysed
rudikz-diplomu[.]ru	urlscan.io only, not analysed
rudikl-diplomd[.]ru	urlscan.io only, not analysed
rudikv-diplomt[.]online	urlscan.io only, not analysed
rudikv-diplomt[.]ru	urlscan.io only, not analysed
rudikm-diplomh[.]ru	urlscan.io only, not analysed
rudikq-diplomr[.]click	urlscan.io only, not analysed
russb-diplomq[.]ru	urlscan.io only, not analysed
russc-diplomn[.]ru	urlscan.io only, not analysed
russk-diplomm[.]online	urlscan.io only, not analysed
goznakc-diplomo[.]online	urlscan.io only, not analysed
express-diplomiq[.]lol	urlscan.io only, not analysed
originalr-diplomr[.]click	urlscan.io only, not analysed
originalj-diplome[.]online	urlscan.io only, not analysed
freex-diplomb[.]ru	urlscan.io only, not analysed
sxz-diplomai[.]online	urlscan.io only, not analysed
diplomq-groupi[.]ru	urlscan.io only, not analysed
diplomi-groupu[.]ru	urlscan.io only, not analysed
frees-diplomsjq8[.]ru	urlscan.io only, not analysed
rda-diplomx[.]ru	urlscan.io only, not analysed
rdo-diploms[.]online	urlscan.io only, not analysed
premiumi-diplomw[.]online	urlscan.io only, not analysed
onlinez-diplomz[.]ru	urlscan.io only, not analysed
russiae-diplomd[.]ru	urlscan.io only, not analysed
rudiplomsxw9[.]ru	urlscan.io only, not analysed

H. "Authorize" carding storefront family (30)

Evidence class: title or hostname contains authorize / authorise / authorlze in the fullz and cvv-shop title searches.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
authorizecvv[.]io	10/100 (scam)
authorizecvv[.]pro	45/100 (warning)
authorizedcvvdumps[.]mp	10/100 (scam)
authorisecvv[.]com	urlscan.io only, not analysed
authorize-cvv[.]com	urlscan.io only, not analysed
authorize-cvv[.]in	urlscan.io only, not analysed
authorize[.]best	urlscan.io only, not analysed
authorize[.]casa	urlscan.io only, not analysed
authorize[.]cash	urlscan.io only, not analysed
authorize[.]credit	urlscan.io only, not analysed
authorize[.]rest	urlscan.io only, not analysed
authorizecc[.]shop	urlscan.io only, not analysed
authorizecvv[.]at	urlscan.io only, not analysed
authorizecvv[.]biz	urlscan.io only, not analysed
authorizecvv[.]cm	urlscan.io only, not analysed
authorizecvv[.]com	urlscan.io only, not analysed
authorizecvv[.]ru	urlscan.io only, not analysed
authorizecvv[.]shop	urlscan.io only, not analysed
authorizecvvv[.]in	urlscan.io only, not analysed
authorized[.]best	urlscan.io only, not analysed
authorized[.]casa	urlscan.io only, not analysed
authorized[.]cash	urlscan.io only, not analysed
authorized[.]rest	urlscan.io only, not analysed
authorizedcvv[.]in	urlscan.io only, not analysed
authorizedcvv[.]io	urlscan.io only, not analysed
authorizedcvv[.]pro	urlscan.io only, not analysed
authorizevcc[.]in	urlscan.io only, not analysed
authorizevcc[.]io	urlscan.io only, not analysed
authorizevv[.]in	urlscan.io only, not analysed
authorlzecvv[.]cc	urlscan.io only, not analysed

I. Sites using the SSNDOB name (8)

Evidence class: brand name and page design.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
ssndob[.]shop	10/100 (scam)
ssndob[.]pw	40/100 (warning)
ssndob[.]me	40/100 (warning)
ssndob[.]io	40/100 (warning)
ssndob[.]pro	40/100 (warning)
ssndob[.]uk	40/100 (warning)
ssndob[.]cx	40/100 (warning)
ssn24[.]top	20/100 (scam)

J. Russian-hosted CVV shops (lead) (10)

Evidence class: .su/.ru, alidns and internetget.su name servers.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
cvv-net[.]su	10/100 (scam)
cvv-shop[.]su	12/100 (scam)
cvv2[.]su	45/100 (warning)
cvv4you[.]su	10/100 (scam)
cvv-com[.]su	10/100 (phishing)
cvvcheck[.]ru	40/100 (warning)
pawn-shop[.]cc	10/100 (scam)
cardingshop[.]ru	12/100 (scam)
cardingclub[.]ru	10/100 (scam)
cvv[.]su[.]at	55/100 (unknown)

K. The .mp carding wave (13)

Evidence class: shared Telegram support account (three) and the September to December 2024 wave.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
primecvv[.]mp	10/100 (scam)
eracvvs[.]mp	10/100 (scam)
fullz[.]bestcvvshop[.]mp	10/100 (scam)
fullz[.]validccshops[.]mp	10/100 (scam)
validccshops[.]mp	10/100 (scam)
marketcvv[.]shop	10/100 (scam)
topcc[.]marketcvv[.]shop	10/100 (scam)
liveccvv[.]mp	10/100 (scam)
livecvvdumpshop[.]mp	10/100 (scam)
livecvvdumps[.]mp	10/100 (scam)
cvvfullzshop[.]mp	10/100 (scam)
bclubcvv[.]mp	10/100 (scam)
eracvv[.]me	10/100 (scam)

Other carding, fullz, dumps and bank-log shops (54)

Evidence class: carding detector.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
cvvmarket[.]cc	12/100 (scam)
cvvmarket[.]store	10/100 (inactive)
cvvmarket[.]net	urlscan.io only, not analysed
cvvcard[.]lv	45/100 (inactive)
starcvv[.]at	12/100 (scam)
santacvv[.]shop	10/100 (scam)
nextcvv[.]cc	10/100 (scam)
beyondcvv[.]cc	15/100 (scam)
glupcvv[.]co	10/100 (scam)
uscvvfullz[.]cc	10/100 (scam)
cvvplug[.]com	10/100 (scam)
cvvglitch[.]com	10/100 (scam)
cvvclub[.]in	10/100 (scam)
ascvv[.]ru	10/100 (scam)
xcvv[.]cc	10/100 (scam)
dumpcvv[.]live	10/100 (scam)
darkcvvshop[.]cc	10/100 (scam)
darkcvv[.]pw	10/100 (scam)
cvvmart[.]com	10/100 (scam)
yxxcvvi[.]com	10/100 (scam)
validcvv[.]cc	10/100 (scam)
fullzccshop[.]cc	10/100 (scam)
cvvfullzshop[.]cc	10/100 (scam)
fullzinfo[.]pw	10/100 (scam)
fullzinfo[.]info	10/100 (scam)
thefullz[.]shop	10/100 (scam)
fullzmarketplace[.]com	10/100 (inactive)
fullzshops[.]cc	10/100 (warning)
cvvshops[.]cc	10/100 (scam)
cvvshops[.]com	45/100 (warning)
cvvshop[.]my	40/100 (warning)
cvvstore[.]live	40/100 (warning)
dumpscvv[.]cc	45/100 (warning)
dumpscvv[.]su	12/100 (scam)
dumpsshop[.]cc	40/100 (warning)
legitdumps[.]com	20/100 (warning)
pitdumps[.]com	20/100 (warning)
buyccandcvvonlineshop[.]com	10/100 (scam)
trump-cvv[.]com	10/100 (scam)
trumps-cc[.]io	40/100 (warning)
russianmarkit[.]to	10/100 (scam)
ulitimateshop[.]to	45/100 (warning)
skimbay[.]com	10/100 (scam)
alphabaymarket[.]shop	20/100 (warning)
echopinlogs[.]pro	10/100 (scam)
darknetforum[.]su	12/100 (scam)
carding-genie[.]cm	12/100 (scam)
mydarkreviews[.]com	12/100 (scam)
legitcarders[.]ws	10/100 (inactive)
scannablecards[.]com	10/100 (scam)
banklog[.]mp	10/100 (scam)
bankshop[.]mp	urlscan.io only, not analysed
banklogstore[.]mp	urlscan.io only, not analysed
banklogshop[.]mp	urlscan.io only, not analysed

Counterfeit money and clone-card shops (33)

Evidence class: titles and link rings.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
counterfeitguru[.]com	12/100 (scam)
undetectedbanknotes[.]com	50/100 (inactive)
clonecardnotes[.]com	10/100 (scam)
buyclonecardsonline[.]net	12/100 (scam)
trustedbillsandclones[.]com	12/100 (scam)
variablebills[.]com	10/100 (scam)
litfakes[.]com	10/100 (scam)
billsbuffbanknotes[.]com	urlscan.io only, not analysed
authenticchemlab[.]com	urlscan.io only, not analysed
billsccnotes[.]com	urlscan.io only, not analysed
legitfakemoney[.]com	urlscan.io only, not analysed
billnotedocs[.]com	urlscan.io only, not analysed
supercounterfeitmoney[.]com	urlscan.io only, not analysed
topnotchnotes[.]com	urlscan.io only, not analysed
counterfeitfutures[.]com	urlscan.io only, not analysed
clonedcardradar[.]com	urlscan.io only, not analysed
clonecounterfeit[.]com	urlscan.io only, not analysed
counterfeitbanknoteshop[.]com	urlscan.io only, not analysed
getcardsclones[.]com	urlscan.io only, not analysed
supremequalitynotes[.]com	urlscan.io only, not analysed
globalnoteslabs[.]com	urlscan.io only, not analysed
hypercloneshop[.]com	urlscan.io only, not analysed
cloncardnotes[.]com	urlscan.io only, not analysed
globalnotelab[.]com	urlscan.io only, not analysed
banknotesdelarue[.]com	urlscan.io only, not analysed
counterfeit-money[.]com	urlscan.io only, not analysed
topcounterfeitlab[.]com	urlscan.io only, not analysed
banknoteandclonecards[.]com	urlscan.io only, not analysed
onlineclonecardsshop[.]com	urlscan.io only, not analysed
clonedcardstoreusa[.]com	urlscan.io only, not analysed
trustedbillsandclonecard[.]com	urlscan.io only, not analysed
discreetclonedcards[.]com	urlscan.io only, not analysed
clonedcardplug[.]com	urlscan.io only, not analysed

L. Darknet mirror and gateway candidates (24 (sample))

Evidence class: templated "official onion links" and "Кракен" titles; full member lists below.

Indicator (defanged; links to the ScamMinder report where one exists)	ScamMinder trust score
nexusmirror[.]org	40/100 (inactive)
darknet[.]nexusofficial[.]link	20/100 (inactive)
nexusonion[.]digital	20/100 (scam)
torzon[.]name	40/100 (warning)
slon1vpn[.]com	urlscan.io only, not analysed
bestdarknet[.]com	10/100 (scam)
darknet[.]cfd	10/100 (scam)
nexus-url[.]info	urlscan.io only, not analysed
nexuslinks[.]store	urlscan.io only, not analysed
mirror[.]nexus-tor-market[.]cc	urlscan.io only, not analysed
trznmarket1[.]com	urlscan.io only, not analysed
torzon[.]pics	urlscan.io only, not analysed
torzon-mirrors[.]online	urlscan.io only, not analysed
darkmatter-dark[.]info	urlscan.io only, not analysed
darkmarketscope[.]com	urlscan.io only, not analysed
druhub-hub[.]digital	urlscan.io only, not analysed
drughub-market-link[.]icu	urlscan.io only, not analysed
blackops-url[.]sbs	urlscan.io only, not analysed
tor-li[.]org	urlscan.io only, not analysed
help[.]kraken-tor[.]co[.]com	urlscan.io only, not analysed
krakenart23[.]com	urlscan.io only, not analysed
ssylka-kraken[.]xyz	urlscan.io only, not analysed
platform-kraken[.]cc	urlscan.io only, not analysed
kraken-dostup[.]ru	urlscan.io only, not analysed

Evidence appendix

Every relationship claimed above, with the identifier or resource, the evidence class, the urlscan.io scan it was read from (unlisted scans, viewable by link) and the confidence we attach. Scans dated 20 October 2026 are ours; earlier ones are from urlscan.io's public index.

Source	Destination	Shared identifier or resource	Relationship type	Scan	Note	Confidence
idlord.com	idpapa.com	request to yoloids.matomo.cloud and an.kingdream.vip	shared analytics tenant + tracking host	01a159d8… (2026-10-20 15:05), 01a159d8… (2026-10-20 15:05)	Both scans request the same Matomo Cloud tenant and the same tracking host. A shared tenant may also mean a shared contractor.	high (shared operator-side resource)
idlord.com	idpapa.com	MX mxw/mxn.mxhichina.com; registrar Hosting Concepts (Registrar.eu)	infrastructure (mail + registrar)	ScamMinder evidence ledger	From ScamMinder DNS/RDAP evidence. Context only.	low
idlord.com	idlord.ph	outbound link "Shop Now" to https://www.idlord.ph/	cross-link	01a159d8… (2026-10-20 15:05)	Linked from a scanned page ("Shop Now" button); destination not scanned.	lead
idlord.com / idpapa.com	yoloids.com	Matomo tenant name "yoloids"	candidate association (resource name)	01a159d8… (2026-10-20 15:05)	The Matomo Cloud tenant is named "yoloids"; yoloids.com was not scanned and appeared in no retrieved urlscan.io result. Ownership unverified. ScamMinder's own capture places it on Alibaba Cloud with a CN registrant.	candidate
idgod.ph	idpimp.ph	Telegram idgodphfakeidscom; WhatsApp +1 601 658 0419	shared contact identifiers	01a159d8… (2026-10-20 15:05), 01a159d8… (2026-10-20 15:05)	Exact match of two identifiers in both DOM snapshots.	high
idgod.ph	idgod.com.ph	contact inbox idgod@idgod.ph	shared contact identifier	01a159d8… (2026-10-20 15:05)	From the ScamMinder identifier ledger (2 domains carry the inbox); idgod.com.ph is dead and was not scanned.	medium
idpark.cc	idpark.ph	one Telegram handle	shared contact identifier	ScamMinder evidence ledger	ScamMinder identifier ledger (2024 captures); both domains are dead and were not scanned.	medium (historical)
idtop.ph	idbook.ph	Telegram idzone_Discount vs idbook_Discount; MX netease / qq; DNSPod	similar naming + Chinese mail providers	01a159d8… (2026-10-20 15:05), 01a159d8… (2026-10-20 15:05)	NOT a shared identifier: the two channels differ. Listed as a lead only.	low
idgod.com	bogusbraxtor.com	AS202412 Omegatech	hosting network only	01a159d8… (2026-10-20 15:05)	bogusbraxtor.com seen on Omegatech in urlscan search (2026-10-19). No operator link.	low
distrodelsanto.com	mdmadelivery.co.uk, mdmadelivery.ca, ukcocainedelivery.com, cocainedelivery.ca, alphamms.co	page.ip 198.251.84.129	shared origin IP (shared host)	01a159d7… (2026-10-20 15:04), 01a0b92f… (2026-09-19), 01a13d96… (2026-10-15), 01a12cf2… (2026-10-11), 01a0c132… (2026-09-20), 019faa16… (2026-07-28)	urlscan page.ip search, 612 results / 312 hostnames on this IP dated 22 Jul–20 Oct 2026; the same IP also serves fake banks and a Monzo phishing page, so it is a shared abusive host, not one operator.	medium (same server); ownership unresolved
distrodelsanto.com	authenticdocsagency.com + 9 other FranTech-network shops	AS53667 FranTech (PONYNET), other IPs	hosting network only	01a07dd2… (2026-09-07)	Earlier draft listed these as the same server; they are on other FranTech addresses. Lead only.	low
mollynl.com	buyrc.org, chemsocean.com, jeffbenzos.net	IP 66.23.195.156; NS ns1/ns2.steadyturtle.com; registrar NameSilo	shared hosting IP + NS	ScamMinder evidence ledger	ScamMinder DNS evidence. urlscan page.ip search (21 results, 20 hostnames) shows unrelated sites (restaurant, dental, agencies) on the same IP: shared hosting. Ownership unresolved.	low
annarborpsychedelicsshop.com	psychedelicstore.eu	requests to psychedelicstore.eu (page assets)	cross-domain asset loading	01a159d6… (2026-10-20 15:03)	Could be copying, hotlinking, shared development or shared management.	medium
psychedelicstore.eu	psychedelicsdispensary.net, dmt-vapes.com	SiteGround hosting; mailspamprotection.com MX set	hosting + mail service overlap	ScamMinder evidence ledger	ScamMinder DNS evidence. Weak.	low
dtradeempire.com	20 linked shops (cocaineforsale.co, methcrystals.com, fentvendor.com …)	outbound footer links	cross-links	01a159d7… (2026-10-20 15:04)	Linking behaviour only.	medium (link ring)
gardenweeddispensary.com	ultimatecounterfeit.com, getcardsclones.com, cashcounternotes.com, k2labsspray.com …	outbound footer links	cross-links	01a159d8… (2026-10-20 15:05)	Linking behaviour only.	medium (link ring)
counterfeitguru.com	ketamineguru.com, bluepearlpharmacy.com, unitedgunshopusa.com, counterfeitmoneycity.com …	outbound links	cross-links	01a159d7… (2026-10-20 15:03)	Linking behaviour only.	medium (link ring)
ru-diplomirovanie.com (submitted) → rudiplomir.com (final page)	7 rudik*-diplom* domains	page.ip 185.74.254.106 (WIBO Baltic)	shared origin IP	01a159da… (2026-10-20 15:07)	The submission was redirected off-domain; the storefront, the IP observation and the printed numbers (+7 901 397-07-15, +7 916 105-50-49, 8 800 301-76-90, 1000diploms@gmail.com) belong to rudiplomir.com on 20 Oct 2026. ScamMinder's July 2026 capture of ru-diplomirovanie.com recorded 8 800 301-76-90 and the same inbox. The 274-domain family is a separate title-phrase candidate set.	medium
idtop.ph	fakeidvendors.net	outbound link	cross-link	01a159d8… (2026-10-20 15:05)	Directory site linked from the shop. Operator unknown.	low
drunkid.com	fingerprints.bablosoft.com	requests to fingerprints/customfingerprints.bablosoft.com	third-party resource	01a159d7… (2026-10-20 15:04)	Observation only. Purpose not established.	observation
fullz.bestcvvshop.mp	fullz.validccshops.mp, validccshops.mp	one Telegram support account	shared contact identifier	ScamMinder evidence ledger	ScamMinder identifier ledger (October 2024 captures); domains are dead.	medium (historical)
fullz.validccshops.mp	marketcvv.shop	five identical card BIN prefixes	shared inventory listing	ScamMinder evidence ledger	Weak: could be copied inventory or a common upstream.	low

Search log

All searches run against urlscan.io on 20 October 2026 with no date filter; the results returned were dated 22 July to 20 October 2026. "Hostnames" are distinct page.domain values, "domains" distinct page.apexDomain values. Every search returned fewer than 1,000 results unless marked, so pagination was complete.

Query	Scans	Hostnames	Domains	Inclusion rule	Completeness
page.title:"купить диплом"	407	274	274	title-PHRASE search (not an exact title, ГОЗНАК not required); whole result set = candidate family G; retrieved 2026-10-20 ~14:30 UTC	complete
page.title:"купить диплом" AND page.title:"ГОЗНАК"	196	118	118	narrower family: both phrases in the title; retrieved 2026-10-20 ~16:40 UTC	complete
page.title:"кракен"	818	452	266	title match, then filtered to darknet-gateway wording (ссылк, зеркал, даркнет, вход, площадк, tor, onion …) and excluding film, casino, retail, charity and finance titles	283 hostnames / 188 domains kept; 169 hostnames excluded; member list below and in the CSV
page.title:"onion links"	393	103	101	title match; whole set = candidate set	complete
page.title:"fullz" + page.title:"cvv shop"	120	90	—	hostname or title contains authorize / authorise / authorlze → family H	35 hostnames / 27 domains kept; exact title alone 19 / 17
page.title:"купить права"	56	34	33	title match	complete
page.title:"buy cocaine" + "cocaine online" + "buy cocaine online"	146	24	24	title match, merged	complete
page.ip:198.251.84.129	612	312	—	six listed drug shops present; the rest unrelated or other fraud	complete
page.ip:66.23.195.156	21	20	—	four research-chemical shops from ScamMinder DNS; urlscan shows unrelated sites	complete
page.ip:185.74.254.106	8	8	—	the rudiplomir.com destination of ru-diplomirovanie.com + 7 rudik*-diplom* hostnames	complete
page.asn:AS30860, AS202412, AS53667, AS59939, AS57043	1,000 each (capped)	—	—	used only to confirm hosting-network context; not a membership rule	truncated at 1,000
71 casework hosts submitted as unlisted scans	71 submissions	—	—	13 DNS failures, 3 refused (Tor gateways), 55 accepted, 51 result records, 49 with HTTP status and DOM, 35 rendered a storefront	see manifest

Payment evidence sheet

Every method or service named on a rendered page, with the supporting sentence and its classification. Rows outside the storefront population are shown for completeness and excluded from every total.

Host	Method / service	Classification	Population	Supporting sentence (visible text, truncated)	Note
buycocaineonlinecanada[.]com	Bitcoin	seller-stated acceptance	storefront	screetly. The packaging is Triple vacuum sealed secured, discrete and safe. Secured Payment Method. We accept Bitcoins. No Extra Cost is Involve. Tracking Numbers are provided for all Orders. WARNING	"Secured Payment Method. We accept Bitcoins."
counterfeitguru[.]com	Bitcoin	seller-stated acceptance	storefront	Counterfeit Money for Sale | Buy Counterfeit Money Online Skip to content Pay Via BITCOIN (BTC) or USDT and enjoy an extra 20% DISCOUNT OFF today. Home Shop About Us Payment and Shipping Cart Checkou
counterfeitguru[.]com	USDT	seller-stated acceptance	storefront	Counterfeit Money for Sale | Buy Counterfeit Money Online Skip to content Pay Via BITCOIN (BTC) or USDT and enjoy an extra 20% DISCOUNT OFF today. Home Shop About Us Payment and Shipping Cart Checkout
cvvmarket[.]cc	Bitcoin	seller-stated acceptance	storefront	untry. From USA CVV dumps to EU CVV fullz, we have comprehensive global coverage in our CVV market. Anonymous Bitcoin Payments Buy CVV dumps securely with Bitcoin. Our CVV dumps shop accepts cryptocur
distrodelsanto[.]com	Bitcoin	seller-stated acceptance	storefront	y Cocaine Online | Best Cocaine Shop - Distro Del Santo Attention Before you shop with us, remember to have a Bitcoin wallet ready for payment. Enjoy a hassle-free shopping experience anonymously! Don	"have a Bitcoin wallet ready for payment" — instruction to buyers
drunkid[.]com	Gift cards / game codes	mention	storefront	cuments Track Order Cart Help FAQ How to Order How to Buy Bitcoins With Debit and Credit Card How to Pay with Gift Cards How to Pay with PayPal Photo Instructions for Good Fake ID Blog Contact Us Navb	Homepage navigation link "How to Pay with Gift Cards"; destination page not scanned, so acceptance is not established
drunkid[.]com	PayPal	indirect funding route	storefront	lp FAQ How to Order How to Buy Bitcoins With Debit and Credit Card How to Pay with Gift Cards How to Pay with PayPal Photo Instructions for Good Fake ID Blog Contact Us Navbar text with an inline elem	Homepage navigation link "How to Pay with PayPal"; the linked page (fetched by the reviewer, not in our scan) says PayPal is not accepted directly and explains buying Bitcoin with it
dtradeempire[.]com	Bitcoin	mention	storefront	e cocaine quality, Online cocaine market, Buy cocaine anonymously, Fishscale cocaine prices, Buy cocaine with Bitcoin, Fishscale cocaine quality control, Buy cocaine legally online, Fishscale cocaine	SEO keyword list, not a payment instruction
dtradeempire[.]com	PayPal	mention	storefront	Fishscale cocaine for party, Online cocaine marketplace reviews, Fishscale cocaine shipping, Buy cocaine with PayPal, Online cocaine market FAQs,Fishscale cocaine for sale in Canada, Buy cocaine in th	SEO keyword list, not a payment instruction
gardenweeddispensary[.]com	Bitcoin	seller-stated acceptance	storefront	ion for those looking to buy weed online in bulk quantities. Buy wholesale disposable vapes in Australia with Bitcoin that are safe, reliable, and easy to use. Buy THC vapes online and shipped nationw	promotional sentence; no payment page captured
gradepharma[.]com	Bitcoin	seller-stated acceptance	storefront	nt price is: $100.00. Add to cart ⇆ Compare Quick View Adipotide $ 110.00 Add to cart ⇆ Compare Checkout With Bitcoin and get 10% OFF SHOP NOW Trending Products Doxepin (Silenor) $ 120.00 – $ 150.00 P
idbook[.]ph	Bitcoin	seller-stated acceptance	storefront	yment methods to make it easier for you to purchase your fake id. We accept the following payment methods: 1. Bitcoin/Bitcoin Cash – We accept these to make it easier for you to purchase your identity
idbook[.]ph	Cash App	indirect funding route	storefront	Bitcoin/Bitcoin Cash – We accept these to make it easier for you to purchase your identity cards. You can use Cashapp , Coinbase or any other wallet to send Bitcoins or Bitcoin cash to the addresses g	wallet named for sending Bitcoin
idbook[.]ph	Coinbase	indirect funding route	storefront	tcoin Cash – We accept these to make it easier for you to purchase your identity cards. You can use Cashapp , Coinbase or any other wallet to send Bitcoins or Bitcoin cash to the addresses generated a	wallet named for sending Bitcoin
idbook[.]ph	Gift cards / game codes	seller-stated acceptance	storefront	or any other wallet to send Bitcoins or Bitcoin cash to the addresses generated at your check out. 2. Amazon Gift Cards – We accept Amazon gift cards personally purchased from stores like Walmart, Wal
idbook[.]ph	PayPal	indirect funding route	storefront	are electronic gift cards and can be purchased online using your credit or debit card. You may also use your Paypal account to purchase Razer Gold E-gift codes and pay using the codes obtained on your	PayPal used to buy Razer Gold codes from a third party
idgod[.]ph	Apple Pay	seller-stated acceptance	storefront	t type of payments do we accept? Secure Payment Options : Bitcoin (BTC) & other cryptocurrencies Google Pay & Apple Pay Discreet cash payments View Payment Options Our ID Card Collection We cover all
idgod[.]ph	Bitcoin	seller-stated acceptance	storefront	ed to match DMV standards for reliable scanning. What type of payments do we accept? Secure Payment Options : Bitcoin (BTC) & other cryptocurrencies Google Pay & Apple Pay Discreet cash payments View
idgod[.]ph	Google Pay	seller-stated acceptance	storefront	Secure Payment Options : Bitcoin (BTC) & other cryptocurrencies Google Pay & Apple Pay Discreet cash payments
idlord[.]com	Bitcoin	seller-stated acceptance	storefront	eamless passage under UV inspection. LEARN MORE Mainstream Secure Payment Methods We accept gift cards, USDT, BTC, and many other payment options. Please check with customer service for the latest opt
idlord[.]com	Gift cards / game codes	seller-stated acceptance	storefront	ibbons, ensuring seamless passage under UV inspection. LEARN MORE Mainstream Secure Payment Methods We accept gift cards, USDT, BTC, and many other payment options. Please check with customer service
idlord[.]com	USDT	seller-stated acceptance	storefront	ring seamless passage under UV inspection. LEARN MORE Mainstream Secure Payment Methods We accept gift cards, USDT, BTC, and many other payment options. Please check with customer service for the late
idpapa[.]com	Bitcoin	seller-stated acceptance	storefront	ring your novelty ID arrives safely. Our payment options cater to your needs, offering the confidentiality of BTC/credit card/gift cards and more, alongside traditional methods without compromising yo
idpapa[.]com	Credit/debit card	seller-stated acceptance	storefront	offering the confidentiality of BTC/credit card/gift cards and more
idpapa[.]com	Gift cards / game codes	seller-stated acceptance	storefront	y ID arrives safely. Our payment options cater to your needs, offering the confidentiality of BTC/credit card/gift cards and more, alongside traditional methods without compromising your personal info
idpapa[.]com	USDT	seller-stated acceptance	storefront	arious purposes, from entertainment to credit card applications. 100% Security Delivery We accept Gift cards, USDT, BTC, and more. For privacy purposes, we update payment methods regularly. Please con
idpimp[.]ph	Bitcoin	seller-stated acceptance	storefront	t option. All orders ship from our facility with stealth packaging to protect your privacy. Accepted Payments Bitcoin (BTC) - Our preferred and most secure payment method. Other Cryptocurrencies - We
lsdeu[.]com	Bitcoin	seller-stated acceptance	storefront	SD Blotters , LSD Gel Tabs, Liquid LSD with fast and discreet shipping from our local hubs. Pay securely with Bitcoin, Monero and other major cryptocurrencies. Featured Products Ecstasy Pills 230mg Or
lsdeu[.]com	Monero	seller-stated acceptance	storefront	rs , LSD Gel Tabs, Liquid LSD with fast and discreet shipping from our local hubs. Pay securely with Bitcoin, Monero and other major cryptocurrencies. Featured Products Ecstasy Pills 230mg Order Onlin
mandspyschedelics[.]com	Bitcoin	seller-stated acceptance	storefront	ect options This product has multiple variants. The options may be chosen on the product page BULK BUYING AND BITCOIN PAYMENT For customers who buy in bulk or pay via bitcoin will earn themselves a fr
mandspyschedelics[.]com	Cash App	seller-stated acceptance	storefront	tsapp us Start a Conversation Hi! Click below to chat on Whatsapp Need assistance for how to pay via BITCOIN, CASHAPP, ZELLE The team typically replies in a few minutes. Text Us Via Whatsapp Login Use
mandspyschedelics[.]com	Zelle	seller-stated acceptance	storefront	Start a Conversation Hi! Click below to chat on Whatsapp Need assistance for how to pay via BITCOIN, CASHAPP, ZELLE The team typically replies in a few minutes. Text Us Via Whatsapp Login Username or
mdmacanada[.]cc	Bitcoin	seller-stated acceptance	storefront	t Shipped Within 24hrs All you need to do next is follow the simple instructions for an Interac E-transfer or BItcoin. Once payment is complete, you can sit back & relax. Your order is on its way! Shi	"instructions for an Interac e-transfer or Bitcoin"; Interac also named
mdmacanada[.]cc	Interac e-transfer	seller-stated acceptance	storefront	All you need to do next is follow the simple instructions for an Interac E-transfer or BItcoin.
oceantranslogisticcargo[.]com	Bitcoin	seller-stated acceptance	storefront	gift will automatically be included in all qualifying orders. 20% OFF WITH CRYPTO PAYMENT $500+ WE NOW ACCEPT BITCOIN BUY MDMA Canada | Buy ketamine Online At BUY MDMA Online Canada , you can BUY MDMA
onlinepsychedelicsmarket[.]com	Bitcoin	seller-stated acceptance	storefront	rypto Currency Dismiss Skip to content Search for: Home Shop FAQs Contact Us ABOUT US My Account Wishlist Buy Bitcoin Cart / $ 0.00 0 No products in the cart. Return to shop Buy Bitcoin 0 Cart No prod
onlinepsychedelicsmarket[.]com	Ethereum	seller-stated acceptance	storefront	Buy Psychedelics Online – Legal Psychedelics For Sale Get 10% Off When Paying With BTC, ETH or Any Other Crypto Currency Dismiss Get 10% Off When Paying With BTC, ETH or Any Other Crypto Currency Dism
pharmasource1[.]com	Bitcoin	seller-stated acceptance	storefront	We Offer Free Shipping Via Express Delivery Money Back Guarantee 100% Satisfaction Guarantee 10% Discount for Bitcoin Bitcoin Payment Is Very Fast, Safe, Secure And Fast Pharma Source This site is int
powderhemisphere[.]com	Bitcoin	seller-stated acceptance	storefront	cts in the cart. Home Shop FAQ / Delivery Video stuck Review Refund / Returns Policy Same day delivery Blog ₿ Bitcoin Pay with crypto & enjoy 20% instant discount 20% OFF BTC ONLY RUN BY REAL & TRUSTE
starcvv[.]at	Bitcoin	mention	storefront	ites, no cvv required shopping , shop online without cvv code, dynamic cvv. Buy cvv fullz, free cvv shop, buy bitcoin with cvv. Latest CVV 2021 STARCVV | CVV SHOP | BUY CC. It is hard to get a legit C	SEO keyword list
starcvv[.]at	PayPal	mention	storefront	ard, shop online without cvv, cvv shop forum, dumps shop list, fresh cvv for sale, cvv vendor. buy cvv2 , ccv paypal, best site to buy cc online, sell dumps cvv, free credit card fullz, bigbase cvv, n	SEO keyword list
toseina[.]com	Bitcoin	seller-stated acceptance	storefront	agram Twitter Youtube VK Contact Summer Sale New Products Fitness Accessories On Sale - 50% Off Free Shipping Bitcoin payment Money back 100% MONEY BACK – 50 % LEGIT AND SEALED BOTTLES Go New REAL Pro
mydarkreviews[.]com	Bitcoin	indirect funding route	excluded: review/directory site, not a seller	uy bitcoins on the coinmama exchange using a stolen card Argos Carding Method and Working Bin 2020 How to buy Bitcoin with a stolen credit card at CoinBase Venmo Carding and Cashout Method 2020 Paypal
mydarkreviews[.]com	Cash App	mention	excluded: review/directory site, not a seller	. Skip to content Fullz, CVV trusted shops review. Is Legit ? Fullz, cvv dumps, hacked western union, paypal, cash app shops user reviews. Carding tutorials and method Menu Home Contact Guides How to
mydarkreviews[.]com	Coinbase	indirect funding route	excluded: review/directory site, not a seller	using a stolen card Argos Carding Method and Working Bin 2020 How to buy Bitcoin with a stolen credit card at CoinBase Venmo Carding and Cashout Method 2020 Paypal Carding, Transfers and Cashout Metho
mydarkreviews[.]com	PayPal	indirect funding route	excluded: review/directory site, not a seller	rking Bin 2020 How to buy Bitcoin with a stolen credit card at CoinBase Venmo Carding and Cashout Method 2020 Paypal Carding, Transfers and Cashout Methods 2020 Skrill carding method Cash App Carding
mydarkreviews[.]com	Skrill	mention	excluded: review/directory site, not a seller	dit card at CoinBase Venmo Carding and Cashout Method 2020 Paypal Carding, Transfers and Cashout Methods 2020 Skrill carding method Cash App Carding Method, Bin and Tutorial 2020 Snapdeal Carding Meth
mydarkreviews[.]com	Venmo	indirect funding route	excluded: review/directory site, not a seller	tolen card Argos Carding Method and Working Bin 2020 How to buy Bitcoin with a stolen credit card at CoinBase Venmo Carding and Cashout Method 2020 Paypal Carding, Transfers and Cashout Methods 2020 S
mydarkreviews[.]com	Western Union / MoneyGram	indirect funding route	excluded: review/directory site, not a seller	ve AVS Search Videos Buy Bank Logs, accounts with emails. Zelle Carding Method 2020 and as the Card Zelle App Western Union carding How to buy bitcoins on the coinmama exchange using a stolen card Arg
mydarkreviews[.]com	Zelle	indirect funding route	excluded: review/directory site, not a seller	nstructions for virtual carding when cards do not have AVS Search Videos Buy Bank Logs, accounts with emails. Zelle Carding Method 2020 and as the Card Zelle App Western Union carding How to buy bitco
mynymbox[.]io	Bitcoin	seller-stated acceptance	excluded: hosting provider (infrastructure lead)	g In Privacy-Focused Hosting Virtual private servers, web hosting, and private domain registrations. Pay with BTC, Monero, Lightning, and more. Sign up with only a working email address; no personally
mynymbox[.]io	Credit/debit card	mention (negative)	excluded: hosting provider (infrastructure lead)	led from your identity. That path is powered by TrocadorApp at checkout. No wire transfers, no PayPal, and no credit cards accepted directly. Frequently asked questions What personal information do yo
mynymbox[.]io	Litecoin	seller-stated acceptance	excluded: hosting provider (infrastructure lead)	K No personal details required Email alias accepted Accepted payment methods Cryptos Bitcoin Lightning Monero Litecoin ZCash + more coins via an integrated privacy swap. Server control Root access Eve
mynymbox[.]io	Monero	seller-stated acceptance	excluded: hosting provider (infrastructure lead)	Privacy-Focused Hosting Virtual private servers, web hosting, and private domain registrations. Pay with BTC, Monero, Lightning, and more. Sign up with only a working email address; no personally iden
mynymbox[.]io	PayPal	mention (negative)	excluded: hosting provider (infrastructure lead)	mous and decoupled from your identity. That path is powered by TrocadorApp at checkout. No wire transfers, no PayPal, and no credit cards accepted directly. Frequently asked questions What personal in
myoro[.]co	Apple Pay	seller-stated acceptance	excluded: consumer shop (sexual-health devices); not illicit goods	Sign up Facebook Instagram Language English English Español Français Deutsch Payment methods American Express Apple Pay Diners Club Discover Google Pay Mastercard PayPal Shop Pay Visa © 2026, Myoro |
myoro[.]co	PayPal	seller-stated acceptance	excluded: consumer shop (sexual-health devices); not illicit goods	spañol Français Deutsch Payment methods American Express Apple Pay Diners Club Discover Google Pay Mastercard PayPal Shop Pay Visa © 2026, Myoro | ECOM SG LLC | All rights Reserved | DMCA Protected Pr

Candidate family member lists

Registrable domains, defanged, as returned by the searches in the log; none of these has been analysed by ScamMinder unless it also appears in the tables above. A registrable domain here is an aggregation key, not a whole-domain blocking recommendation: the observation behind each row is one captured URL, and the parent domain may carry unrelated content, a compromised page or hosted content. The complete six-family mapping with the observed hostname, URL, scan id and timestamp for every one of the 753 observations is published as a CSV: illicit-shops-candidate-families-20261020.csv. The file sits on ScamMinder's CDN, which answers automated clients and datacenter addresses with a Cloudflare 403; download it from a browser, or write to support@scamminder.com and we will send the file. "Outside this study's corpus" means the registrable domain (www, subdomains and paths reduced to the registrable domain; submitted hostnames, not redirect destinations) is not the registrable domain of any of the 173 corpus records; six of the 647 exist elsewhere in the full ScamMinder database.

"Кракен" gateway candidates after filtering (188): 121644[.]cc, 1kraken-1kraken[.]ru, 2kraken2kraken[.]ru, 3-kraken[.]cc, astra-consul[.]ru, biz-meeting[.]com, bloggapedia[.]com, boyenhaddin[.]com, brain-supports-sports[.]com, bruxy[.]com, citapreviaextranjeria[.]com[.]es, d2web[.]link, darkbrowser[.]pro, ducastudio[.]com, eedblog[.]com, f7n[.]team, freerobuxnoverification[.]co, godnataba[.]com, hiddenherstories[.]org, id-rank[.]com, ik-press[.]com, jaipurflooring[.]com, k-3-kraken-com[.]pages[.]dev, k-kraken-c-cc[.]pages[.]dev, kgame2026[.]games, kk-2-kraken-cc[.]pages[.]dev, kk-kraken-k-cc[.]pages[.]dev, kk-krakenmarkets-cc[.]pages[.]dev, kk-krakensongs-cc[.]pages[.]dev, kra-ssylka[.]com, kra31f[.]cc, kra33----------cc[.]ru, kra47ccc[.]ru, krab4at-kraken[.]ru, krak-2[.]icu, krak-3[.]live, krak-3[.]top, krak-4[.]top, krak-ssylka[.]cc, krak24[.]ch, krak24[.]live, krake[.]co[.]com, kraken-----zerkalo[.]info, kraken----zerkalo[.]info, kraken--2kr[.]ru, kraken--shop[.]ru, kraken-2[.]ru, kraken-best[.]ru, kraken-c[.]cc, kraken-captcha[.]ru, kraken-d-shop[.]top, kraken-darknet-to[.]pages[.]dev, kraken-darknet24[.]com, kraken-dostup[.]ru, kraken-drk-shop[.]ru, kraken-klirnet-vhod[.]sbs, kraken-krab[.]co[.]com, kraken-krak[.]ru, kraken-link-slonkr[.]co, kraken-market-24[.]ru, kraken-market[.]to, kraken-marketplace-ssylka[.]help, kraken-marketplace[.]com, kraken-mirror-onion[.]ru, kraken-mirrors-onion[.]ru, kraken-one[.]ru, kraken-poisk[.]ru, kraken-sayt[.]ru, kraken-shop[.]co[.]com, kraken-slon-tor[.]ru, kraken-slon-zerkalo[.]ru, kraken-slon13-cc[.]info, kraken-slon7-cc[.]ru, kraken-ssylka-na-vhod[.]com, kraken-ssylka[.]co[.]com, kraken-tor-dark[.]net, kraken-tor[.]co[.]com, kraken-v2tor[.]info, kraken-vhod-onion[.]ru, kraken-zerkalo-darknet[.]ru, kraken-zerkalo[.]at, kraken1[.]co[.]com, kraken15[.]shop, kraken2026[.]xyz, kraken23tor[.]com, kraken25-at[.]net, kraken2kr[.]ru, kraken3onion[.]com, kraken8darknet[.]com, krakenart23[.]com, krakenbot-cc[.]pages[.]dev, krakenbridge[.]net, krakencasinogiris[.]com, krakenclir[.]com, krakendarkvk[.]com, krakenhome[.]top, krakenhorizon[.]com, krakenhowto-cc[.]pages[.]dev, krakenkrstore[.]com, krakenkuch[.]com, krakenlight[.]net, krakenlinks[.]co, krakenmanual-cc[.]pages[.]dev, krakenmanual[.]cc, krakenmarket[.]cv, krakenmatrix[.]com, krakenoffoff[.]com, krakenonion[.]life, krakenonionsite[.]com, krakenpath[.]net, krakenplatform-cc[.]pages[.]dev, krakens[.]co[.]com, krakensell[.]com, krakensite1[.]com, krakensongs[.]cc, krakenssylka[.]org, krakenssylka[.]site, krakenter-cc[.]pages[.]dev, krakentext-cc[.]pages[.]dev, krakentext[.]cc, krakentor-to[.]pages[.]dev, krakentor[.]to, krakentor0[.]com, krakenvision[.]net, krakenvk[.]com, krakenweb[.]click, krakonion[.]com, krkm-to[.]at, krkn-marketplace[.]live, krkn-site[.]info, krkn-site[.]top, krkn-ssylka[.]cc, krkn12[.]com, krkn45[.]com, krkns[.]com, krkraken[.]ru, krnm[.]site, krslon8[.]cc, krssilka[.]com, krticket-cc[.]pages[.]dev, krticket-net[.]pages[.]dev, krticket[.]cc, krticket[.]net, kslon[.]top, lmsd[.]team, mattwilsonco[.]com, my-kraken[.]ru, newportnh[.]net, onlinebikestudio[.]it, orangenet[.]org, permanyer[.]com, platform-kraken[.]cc, razer-kraken-onion[.]com, reg-kraken[.]ru, sarobas[.]ca, sayt-kra[.]com, slokn19[.]cc, slon-at[.]ru, slon-travel[.]com, slon10[.]in, slon13cc[.]info, slon14[.]nl, slon15cc[.]me, slon16cc[.]info, slon1rc[.]com, slon1vpn[.]com, slon3--at-kraken[.]ru, slon3--to-kraken[.]ru, slon3-at-kraken[.]ru, slon3-cc-kraken[.]ru, slon3-to-kraken[.]ru, ssylka-kraken[.]xyz, thekrakenisalive[.]com, tor-kraken[.]com, tordarknetmarket2022[.]shop, trustmp[.]cc, vhod-na-kraken[.]help, voiti-na-kraken[.]ru, xn-----6kcbz0acbd1amsgba1a5l[.]xn--p1ai, xn--krakent-fn4c[.]com, ykrk[.]cc, zerkala-kraken[.]ru, zerkala-krkn[.]com, zerkalo--kraken[.]info, zerkalo-kra[.]com, zerkalo-kraken-onion[.]ru, zerkalo-kraken[.]info, zerkalo-na-kraken[.]top

Diploma title-phrase search (274): 100-diplomyb[.]shop, 100-diplomyg[.]shop, airlineinfo[.]ru, arena-diplomx[.]com, arenadiplomov24[.]click, baango[.]ru, dip-zakaz[.]ru, diplom-online[.]com, diplom-service[.]click, diplom-v-rossii[.]com, diplom1[.]com, diplom911[.]com, diploma-landt[.]online, diplomallgid[.]ru, diplomavuzobr[.]ru, diplome-kusw[.]ru, diplomenok[.]ru, diplomesok[.]ru, diplomf-arusi[.]online, diplomf-lived[.]ru, diplomf-liveg[.]online, diplomf-livey[.]online, diplomf-russiab[.]ru, diplomg-aruso[.]online, diplomg-russiaj[.]online, diplomi-livez[.]ru, diplomiadok[.]ru, diplomiddok[.]ru, diplomiiispb[.]ru, diplomiikbezuchebi[.]ru, diplomiuobr[.]ru, diplomizzbezuchebi[.]ru, diplomj-kush[.]online, diplomj-liveg[.]online, diplomk-arusx[.]ru, diplomk-liver[.]online, diplomk-russiaw[.]ru, diploml-landg[.]ru, diplomliiobr[.]ru, diplomlive-yandex[.]ru, diplommngid[.]ru, diplommogid[.]ru, diplomnewmos[.]ru, diplomnewspb[.]ru, diplomnomos[.]ru, diplomnovrus[.]ru, diplomobrobr[.]ru, diplomoxobr[.]ru, diplomp-landh[.]online, diplomq-kusg[.]ru, diplomr-livea[.]ru, diploms-arush[.]ru, diplomtodorus[.]ru, diplomuch[.]ru, diplomuchvspb[.]ru, diplomv-kuse[.]ru, diplomv-russian[.]online, diplomvisobr[.]ru, diplomvoospb[.]ru, diplomx-livew[.]ru, diplomy-russial[.]ru, diplomyzz-24[.]ru, diplomz-kush[.]online, diplomzispb[.]ru, diplomzzaobr[.]ru, duvmhxx-diplomapricesdiplomapricesdiplomapr-diplomaprices[.]click, dyplom365[.]online, e-diplomkk[.]ru, e-diplomnis[.]ru, e-diplomnow[.]ru, e-diplomzzo[.]ru, edugate[.]kz, eomybxx-legaldiplomlegaldiplomlegaldiplomlega-legaldiplom[.]click, express-diplomiq[.]lol, free-diplomybx4[.]ru, free-diplomygx10[.]ru, free-diplomyis10[.]ru, free-diplomylh20[.]ru, freea-diplomea[.]ru, freea-diplomia[.]ru, freea-diplomoa[.]ru, freea-diplomra[.]ru, freea-diplomua[.]ru, freea-diplomya[.]ru, freeb-diplomw[.]online, freed-diplomx[.]ru, freee-diplomg[.]online, freee-diplomt[.]online, freee-diplomt[.]ru, freef-diplomo[.]online, freeg-diplomh[.]ru, freei-diplomo[.]ru, freek-diplome[.]online, freem-diplomf[.]online, freem-diplomf[.]ru, freem-diploml[.]online, freem-diploml[.]ru, freen-diplomn[.]ru, freer-diplomi[.]ru, frees-diplom-doci[.]ru, frees-diplomsbf4[.]online, frees-diplomsbf4[.]ru, frees-diplomsbi5[.]ru, frees-diplomsda5[.]online, frees-diplomsjk1[.]ru, frees-diplomsjq8[.]ru, frees-diplomspv5[.]online, frees-diplomsrx3[.]ru, frees-diplomssx5[.]ru, frees-diplomstt8[.]ru, frees-diplomv[.]online, freespb-diplomaa[.]ru, freespb-diplomea[.]ru, freespb-diplomia[.]ru, freespb-diplomoa[.]ru, freespb-diplomra[.]ru, freespb-diplomua[.]ru, freespb-diplomya[.]ru, freet-diploml[.]click, freeu-diplomg[.]online, freeu-diplomy[.]ru, freew-diplomk[.]online, freew-diplomw[.]online, freew-diplomw[.]ru, freex-diplomb[.]ru, freez-diplomf[.]online, freez-diplomf[.]ru, getkurs99[.]ru, gosznak-reestres7[.]ru, gosznak-reestrky5[.]online, gosznak-reestrtv1[.]online, goznakc-diplomo[.]online, goznakf-diplomi[.]ru, goznakg-diplomt[.]online, goznaki-diplomd[.]ru, goznakr-diplomx[.]ru, hfggrt-studydocstudydocstudydocstudydocstudy-studydoc[.]click, kjbwif-arusdiplomarusdiplomaurusdiplomaurusdiploman-arusdiplom[.]club, kupitdiplomt[.]cfd, kypit-diploms[.]com, legalnye-dokumentyy[.]online, legalnye-dokumentyy[.]ru, legalnyea-dokumentya[.]ru, manf-diploma[.]online, mano-diplomj[.]ru, manw-diplomi[.]ru, nhcylxx-ohrannikdocsohrannikdocsohrannikdocs-ohrannikdocs[.]click, onlinea-diplomm[.]ru, onlinec-diplomv[.]online, onlinee-diplomu[.]online, onlinem-diplomi[.]ru, onliner-diploms[.]ru, onlinez-diplomz[.]ru, originald-diplomc[.]ru, originald-diplomm[.]online, originali-diplomf[.]online, originalj-diplome[.]online, originalj-diplomi[.]ru, originall-diplomr[.]online, originalm-diplomc[.]online, originalm-diplomq[.]ru, originaln-diplomu[.]online, originaln-diplomu[.]ru, originalo-diplomn[.]online, originalr-diploma[.]ru, originalr-diplomr[.]click, originalt-diplomh[.]ru, originalx-diploma[.]online, originalz-diplomo[.]online, premiuma-diplomj[.]ru, premiumb-diplomn[.]ru, premiumg-diplomn[.]online, premiumg-diploms[.]online, premiumi-diplomk[.]online, premiumi-diplomk[.]ru, premiumi-diplomw[.]online, premiumi-diplomw[.]ru, premiumz-diplomy[.]online, promnabfi[.]blogspot[.]com, rda-diplomx[.]ru, rdf-diplomo[.]online, rdf-diplomo[.]ru, rdf-diplomp[.]ru, rdn-diplomg[.]ru, rdo-diploms[.]online, rdo-diploms[.]ru, rdr-diplomv[.]online, rdr-diplomv[.]ru, rdt-diploms[.]ru, rdu-diploms[.]online, rdv-diplomv[.]ru, rdw-diplomz[.]online, rdy-diplomg[.]ru, rossnewdiplom[.]ru, ru-diplomirovany[.]com, rudika-diploms[.]online, rudikl-diplomd[.]ru, rudiku-diplomg[.]online, rudikv-diplomt[.]online, rudikv-diplomt[.]ru, rudikz-diplomu[.]ru, rudiplomsch4[.]ru, rudiplomsxw9[.]ru, rus-dip[.]com, russa-diplome[.]online, russb-diplomq[.]online, russb-diplomq[.]ru, russc-diplomn[.]ru, russe-diplomq[.]ru, russf-diplomv[.]ru, russg-diplomc[.]online, russg-diplomc[.]ru, russiab-diplomo[.]ru, russiad-diplomz[.]ru, russiae-diplomd[.]online, russiae-diplomd[.]ru, russiaj-diplomb[.]click, russian-diploman[.]click, russiao-diplomo[.]ru, russiap-diplomc[.]ru, russiaw-diploml[.]online, russiax-diplomz[.]click, russk-diplomm[.]online, russm-diploms[.]ru, russp-diplomw[.]online, russr-diplomh[.]online, russr-diplomh[.]ru, russs-diplomp[.]online, russu-diplomy[.]online, russvpn[.]online, russz-diplomt[.]ru, simiidiplom[.]com, sjuytv-freezdiplom-freezdiplom[.]click, stady-diplomf[.]online, stady-diplomj[.]ru, stady-diplomn[.]online, stady-diplomu[.]ru, stadya-diplomya[.]ru, stadyb-diplomyh[.]online, stadye-diplomys[.]online, stadye-diplomys[.]ru, stadyq-diplomyc[.]online, sxa-diplomaa[.]online, sxc-diplomae[.]online, sxf-diplomaz[.]online, sxf-diplomaz[.]ru, sxh-diplomas[.]ru, sxk-diplomah[.]online, sxk-diplomah[.]ru, sxl-diplomaa[.]online, sxl-diplomao[.]ru, sxp-diplomaw[.]ru, sxr-diplomat[.]online, sxt-diplomak[.]online, sxt-diplomak[.]ru, sxt-diploman[.]ru, sxu-diplomak[.]online, sxu-diplomaw[.]online, sxu-diplomaw[.]ru, sxu-diplomax[.]online, sxu-diplomax[.]ru, sxw-diplomac[.]online, sxx-diplomat[.]online, sxz-diplomai[.]online, sxz-diplomai[.]ru, usqbgxx-prodiplomprodiplomprodiplomprodiplompro-prodiplom[.]click, vip-diplomyh[.]shop, vip-diplomym[.]shop, vip-diplomyt[.]shop, vrnzhxx-diplomprimediplomprimediplomprimedipl-diplomprime[.]click, vuzblegalno24[.]online, vuzxlegalno[.]online, vuzyn-legalnoj[.]ru, yqwert-gosznakereestrfgosznakreestr6-goszn[.]click

"Authorize" storefront family (27): authorisecvv[.]com, authorize-cvv[.]com, authorize-cvv[.]in, authorize[.]best, authorize[.]casa, authorize[.]cash, authorize[.]credit, authorize[.]rest, authorizecc[.]shop, authorizecvv[.]at, authorizecvv[.]biz, authorizecvv[.]cm, authorizecvv[.]com, authorizecvv[.]ru, authorizecvv[.]shop, authorizecvvv[.]in, authorized[.]best, authorized[.]casa, authorized[.]cash, authorized[.]rest, authorizedcvv[.]in, authorizedcvv[.]io, authorizedcvv[.]pro, authorizevcc[.]in, authorizevcc[.]io, authorizevv[.]in, authorlzecvv[.]cc

"Onion links" pages (101): best-nexus[.]digital, best-nexus[.]icu, best-nexus[.]sbs, bestdarknetmarket[.]net, black-link[.]sbs, blackops-onion[.]cyou, blackops-url[.]sbs, blackopsmarket[.]biz, blackopsmarketurl[.]top, catharsis-darknet[.]net, catharsis-market[.]com, dark-matter-marketplace[.]com, dark-matter-url[.]com, darkmarketscope[.]com, darkmatter-dark[.]info, darkmatter-dark[.]xyz, darkmatter-hub[.]sbs, darkmatter-info[.]digital, darkmatter-info[.]sbs, darkmatter-market[.]cyou, darkmatter-market[.]digital, darkmatter-market[.]info, darkmatter-url[.]cyou, darkmatter-url[.]digital, darkmatter-url[.]shop, darknetblackops[.]com, darkstats[.]live, darkweb101[.]com, daunbt[.]link, dhdnm[.]info, drughub-market-link[.]icu, drughub-market-onion[.]icu, drughub-market-onion[.]sbs, drughub-market-onion[.]store, drughub-oniondark[.]cc, drughub[.]sbs, drughubdm[.]vip, drughubmarketmirror[.]info, drughuboniondark[.]com, druhub-hub[.]digital, druhub-market-links[.]cfd, druhub-market-links[.]cyou, druhub-market-links[.]digital, druhub-market-links[.]sbs, druhub-market-url[.]cyou, druhub-url[.]cfd, druhub-url[.]digital, inthehiddenwiki[.]net, mars-darknet[.]com, mars-market[.]vip, nexus-dark[.]icu, nexus-dark[.]sbs, nexus-dark[.]store, nexus-dark[.]xyz, nexus-hub[.]cfd, nexus-hub[.]live, nexus-info[.]best, nexus-info[.]cfd, nexus-info[.]digital, nexus-info[.]info, nexus-info[.]live, nexus-info[.]sbs, nexus-info[.]xyz, nexus-market-link[.]com, nexus-market-url[.]cc, nexus-market[.]cfd, nexus-mirror[.]net, nexus-service[.]watch, nexus-tor-link[.]net, nexus-tor-market[.]cc, nexus-url[.]digital, nexus-url[.]info, nexus-url[.]sbs, nexuslinks[.]store, onion-links[.]info, onion[.]live, top-darkmatter[.]cyou, top-druhub[.]digital, top-nexus[.]sbs, tor-li[.]org, torbible[.]com, torhub[.]net, tornews[.]com, torsearch[.]online, torzon-darknet-mirror[.]com, torzon-darknet[.]icu, torzon-hub[.]best, torzon-hub[.]forum, torzon-hub[.]live, torzon-market-url[.]sbs, torzon-market[.]best, torzon-market[.]net, torzon-mirrors[.]online, torzon-url[.]digital, torzon-url[.]site, torzon[.]pics, torzondarknet[.]link, torzonring[.]com, trznmarket1[.]com, vortex-tor-link[.]net, wethenorth-onion-market[.]com

"Купить права" driving-licence title phrase (33): apjwfxx-motonadzormotonadzormotonadzormotonadz-motonadzor[.]click, dmktcxx-onpravaruonpravaruonpravaruonpravaruon-onpravaru[.]click, elfupxx-pectehnikapravarfpectehnikapra-pectehnikapravarf[.]click, ielrdxx-pravavoditelyapravavoditelyaprava-pravavoditelya[.]click, jcvtieq-kupiupravakupiupravakupiuprava-kupit-prava[.]click, jpsrpxx-pravaonlinepravaonlinepravaonlinepra-prava-online[.]click, kupit-pravavto[.]ru, lrhdbxx-pravanapogruzchikpravanapogru-prava-na-pogruzchik[.]click, ntfabxx-gimsrfpravagimsrfpravagimsrfpravagims-gimsrfprava[.]click, pr-v-nsk-00000001online[.]ru, pr-v-spb-00000001online[.]ru, prava-abc[.]top, prava-abic[.]sbs, prava-cherez-gibdd[.]click, prava-onli[.]online, prava-onlive[.]sbs, prava-spb-fh[.]ru, prava-spb-gw[.]ru, prava-spb-lo[.]ru, prava-spb-nh[.]ru, prava-spb-sh[.]ru, prava-spb-vm[.]ru, prava-spb-xg[.]ru, pravarfspectehnika-xxjuspt[.]click, pravaxa-kupitpravakupitpravakupitpravakupitp-kupit-prava[.]click, pravaxi-kupitpravakupitpravakupitpravakupitp-kupit-prava[.]click, pravaxn-kupitpravakupitpravakupitpravakupitp-kupit-prava[.]click, pravaxq-kupitpravakupitpravakupitpravakupitp-kupit-prava[.]click, pravaxr-kupitpravakupitpravakupitpravakupitp-kupit-prava[.]click, sdatnaprava01[.]ru, skselxx-motonadzormotonadzormotonadzormotonad-motonadzor[.]click, swcxzxx-techpravarutechpravarutechpravarutec-techpravaru[.]click, temlbxx-pectehnikapravarfpectehnikaprav-pectehnikapravarf[.]click

Cocaine title searches (24): astuterevive[.]com, blogdeazar[.]com, buybolivianconline[.]com, buycocaine[.]shop, buycocainedelivery[.]shop, buycocaineonlinedubai[.]com, buycocaineonlineinaustria[.]io, buycocaineonlineinfrance[.]com, buycocainezurich[.]ch, buyonlinecocaine[.]org, buyperuvianonline[.]com, cnento[.]com, cocaine-center[.]com, cocainedelivery[.]ca, cocaineinlondon[.]co[.]uk, cocaineplug[.]org, cocaineshoponline[.]com, cracksnowfrance[.]com, discreetcocainedelivery[.]com, distrodelsanto[.]com, guidetococaineindubai[.]com, melbourneprocedurestore[.]com, premiumcokesupply[.]eu, worldwidecocainedelivery[.]com

Changes from earlier versions

• First revision (20 October, after the first review). Removed four wallet-like strings that failed Base58Check (two were Base64 image fragments). Removed the claim that idtop[.]ph and idbook[.]ph share a Telegram channel. Replaced the 452 "Kraken gateways" with a filtered candidate set. Reduced cluster C to the shops seen on the one origin IP. Reclassified payment evidence as named versus stated as accepted. Renamed the article and every cluster by evidence class and restated behavioural claims as assessments. Corrected Titan, Matomo Cloud, SSNDOB, urlscan-index and Bablosoft wording. Added the status table, search log and this appendix.
• Second revision (20 October, after the second review). Corrected four host statuses from the actual scan content (portentis[.]com rendered a storefront; variablebills[.]com and huntbay-chemicals[.]com are expired-domain parking pages; buycolombiancoke[.]com is a cPGuard verification page; premiumcocainestore[.]com is a default AlmaLinux page) and re-checked all 49, which also moved exoticdispensaries[.]com (filler blog) and mydarkreviews[.]com (review site) out of the storefront count: 35 storefronts, not 39. Published the full 71-host manifest with scan ids. Removed myoro[.]co from the study (consumer shop) and mynymbox[.]io from all statistics (hosting provider): the corpus is 173 records, 121 resolving. Redrew Figure 1 with A1, A2 and A3 apart, solid edges for observed links and dashed edges for inferred membership, and B at six members. Redrew Figure 4 with all 121 records. Rebuilt the payment analysis on the 35-storefront population with a page-level sheet, renamed it "payment methods and services", and counted negative sentences as mentions. Downgraded yoloids[.]com to a candidate and idlord[.]ph to a link lead. Described the diploma family as a title-phrase candidate set and added the narrower ГОЗНАК count (118). Stated the ru-diplomirovanie[.]com redirect to rudiplomir[.]com and dated the contact numbers. Replaced the remaining purpose and churn claims with observations. Changed "Check any link before you pay" to a wording that does not imply a safe purchase. Replaced Action Fraud with Report Fraud (England, Wales, Northern Ireland) and Police Scotland. Corrected every revision date to 20 October 2026. Published the Kraken, diploma, Authorize and onion-links member lists and a deduplicated union.
• Third revision (20 October, after the third review). drunkid[.]com's PayPal row reclassified as an indirect funding route and its gift-card row as an unverified instruction link (navigation-link titles are no longer read as acceptance): PayPal 4 named, 0 stated as accepted; gift codes 4 named, 3 accepted; Figure 5 regenerated. Title and metadata changed from 174 to 173 and the population described as 173 corpus records / 169 registrable domains. myoro[.]co moved from the drug list to an explicit exclusions table (55 remain). Figure 1 hubs now show the real group sizes (274, 289) with dots capped, H relabelled as an Authorize-related title and naming family, and the fourteen hubs explained as twelve clusters with A split in three. The stale 45-page wording replaced by the 49 rendered pages. The Kraken count is 188 after one row with no apex value was keyed by hand, so the union is 647 registrable domains, 646 outside this study; the full six-family mapping with URL-level evidence is published as a CSV, with the driving-licence and cocaine member lists added. Overlapping cluster memberships listed; the lettered sections described as illustrative groupings, not a partition.
• Fourth revision (20 October, after the fourth review). Figure 3 regenerated with 188 / 647 / 646. Excerpt and remaining "173 sites" wording changed to corpus records and registrable domains. The overlap list is now generated from the published tables (distrodelsanto[.]com added to the F linked targets, where dtradeempire[.]com links it; cross-table duplicates listed separately). oceantranslogisticcargo[.]com's earlier use stated as unestablished; buycolombiancoke[.]com's price quote dated to the 13 October capture. Cluster K recounted as thirteen hostnames over September 2024 to April 2025. Figure 1 footer wrapped. A note added on the CDN's Cloudflare 403 for automated downloads of the CSV.

Accuracy and disputes

Every ScamMinder link above goes to a report that shows the evidence behind its score, including the captured page text the detector matched. Scores are produced by the same pipeline as every other site; no site on this list was scored by hand. If you believe a site is listed in error, the dispute process is free and does not require payment or registration, and a corrected verdict is published with its history. Sibling domains found only through urlscan.io have not been analysed by ScamMinder and carry no score; they are listed as leads for defenders, not as verdicts. Internal case and report-packet counts, and identifier matches that rest only on ScamMinder's 2024 captures, cannot be reproduced from public sources; they are marked as ledger evidence wherever they appear.

Sources: ScamMinder casework and evidence ledger (20 October 2026); urlscan.io scans and search results (22 July to 20 October 2026); RDAP and WHOIS registry data; IP geolocation by IPinfo. Hosting providers named here are where the sites were served from at capture time; naming a provider is not a claim that it knew about or approved of the content. Four independent review rounds received 20 October 2026; corrections applied the same day.