Evidence types and directory guide

What's Inside

Each scam operation gets its own directory. Inside, evidence is organized by type:

TeamName/
├── chat/              # Internal Telegram group conversations
├── channel/           # Public channel announcements
├── successful_thefts/ # Confirmed theft records (wallets, tx hashes, amounts)
├── designs/           # Phishing page templates and clone assets
├── payments/          # Payment logs, affiliate payouts
├── scammers_login.txt # Known participant Telegram IDs and usernames
├── domains.txt        # Associated phishing domains
├── iocs.json          # Machine-readable indicators of compromise
└── index.html         # Visual evidence browser for this team

Not every team has all folders — it depends on what evidence was collected. The root index.html lists all archived operations with descriptions and direct links to every subfolder.

Browse the full archive

  Collection methodology

We do NOT hack, attack, bruteforce, or compromise any systems.

All data is collected through passive intelligence gathering:

• 🔍 OSINT — Open-source intelligence from public sources
• 📥 Leaked Data — Community-submitted dumps from insiders
• 🕵️ Social Engineering Artifacts — Data exposed by scammers themselves
• 📡 Passive Monitoring — Public channels, forums, blockchain analysis
• 🎁 Voluntary Submissions — Victims and researchers sharing evidence

When admin panel access is obtained (through leaks or misconfiguration), we conduct non-destructive audits to document infrastructure without modification.

  Purpose, use conditions and license

Who Benefits

Why Archive This

Scammers systematically destroy evidence — deleting Telegram chats, burning wallets, rotating domains. This archive ensures:

• Permanent Record — Evidence survives deletion attempts
• Pattern Analysis — Cross-reference actors across operations
• Accountability — Public exposure deters future activity
• Community Defense — Shared knowledge protects potential victims

Use conditions

• This repository contains evidence of criminal activity for research purposes
• Data is provided "as-is" without verification guarantees
• Do not use this data for harassment, vigilante justice, or illegal purposes
• Victim PII should be handled responsibly
• We are not responsible for misuse of this information

License

The LICENSE contains the MIT software license and additional terms for intelligence data, including research, journalism, anti-fraud work and law enforcement use. Refer to that file for the full terms.