Threat actors are working overtime. Three days of chasing campaigns, watching domains rotate, and trying to get ahead of the next victim. 👇 A bank sign-in clone jumped across 4 domains in 5 days. I reported each one as it appeared. Three hosts pulled theirs, and I caught the fourth the same night it went live. Fake copies of a telecom’s official sites went down 1h 28m, 1h 33m, 5h, and 10h after my reports. A recurring brand scam? Its newest domain lasted just 2h 20m after my report. Then came the worst one: an SMS telling a Nigerian bank’s customers to “verify your identity within 24 hours.” Someone reportedly lost money to this. I traced it to one operation running 8 domains. All 8 reported. Two blocked within an hour. I also found a domain already prepared to impersonate a second bank and reported it to give an heads up. So far, 172 reports since October 12. The actors aren’t slowing down. Neither am I. : )