Risk observations shaped by frontline investigation
We track criminal infrastructure, attack tooling, fraud methods and digital-risk change, turning frontline observations into research that can be searched, cited and used.
English research
39published items
Research focus
Threat economyDigital riskBusiness fraud
Publication standard
Reviewed English editionSource report linkedNo lead form
Featured research
Current featured research
Read the evidence, findings and practical considerations behind changing external risk.
Threat Hunter reviewed private-game-server activity on Telegram channels through October 29, 2026. Behind 1,003 entry points and 106 games sit just 48 server operators, one of which runs as many as 43 games. New supply comes mainly from existing operators rotating games and entry points, not from new groups entering. The things worth tracking are the ones that survive a game swap: operator nodes, agent back-ends, and support accounts.
Drawing on 49 million active risky IPv4 addresses observed between September 27 and October 25, 2026 (77% on residential broadband), Threat Hunter quantifies four operational blind spots in static IP defense: newly observed risky IPs have a ~5-day half-life (32% last 1 day, 42.3% remain on Day 7), requiring a 7–14 day residential ban TTL; 7-day rolling blocklist coverage drops from 84.2% same-day to 79.5% after a 1-day lag and 67.1% after a 7-day lag, while 15.8% of daily risky IPs are first-time appearances; the 14% persistent IPs active ≥15 days drive 63% of risky activity; and 89% of risky IPs in China are hijacked shared home routers requiring step-up verification, while weekly active risky IPs outside China rose 29% in late October to 20.66 million.
Reviewed English editionIP risk intelligenceresidential proxies
As of 29 September 2026, Threat Hunter reviewed 169 public posts and coded 143 transaction amounts. The assessment focuses on attackers obtaining Apple Pay device PANs (DPANs) in bulk and submitting them into card-not-present channels where token scope and cardholder authentication were not enforced.
Reviewed English editionMastercardunauthorized transactions
A single comment can look like ordinary customer feedback. In a task pipeline, it can also be a deliverable: a target post, a required action, proof of completion, then settlement. Threat Hunter monitored 20,000+ related items over roughly one month and identified 1,500+ tasks. Of those, 1,196 were comment tasks; 815 were negative comment tasks — 68.1% of all comment tasks.
Reviewed English editioninauthentic engagementcomment tasks
A half-year assessment of increasingly realistic, coordinated credit fraud across professional debt assumption, mortgage, business, auto, and consumer lending.
Reviewed English editioncredit frauddebt-assumption schemes
