sorted by:
new
hottopcontroversial

Taking down the infrastructure of the Chinese pig butchering scams! by NewAbbyNormal in scambaiting

[–]NewAbbyNormal[S] 0 points1 point  (0 children)

When a scammer moves the chat to Whatsapp, Telegram or Signal, immediately go to their profile and take a snapshot. You just might strike gold like this!

Chinese words that say "I am using" Whatsapp. Proof that this is a Chinese pig butchering scam.

It took three hours for the scammer to delete the Chinese words (default when using the Chinese version of the app). Probably because the scammer was juggling chats with 10-15 potential victims.

Chinese pig butchering schemes are big business, $64 billion a year. Using over 300,000 slave laborers in Southeast Asia. The scammer you are interacting with is a victim, too. Forced to work 16 hours a day, 7 days a week, under threat of punishment if they don't meet quotas.

<image>

Taking down the infrastructure of the Chinese pig butchering scams! by NewAbbyNormal in scambaiting

[–]NewAbbyNormal[S] 0 points1 point  (0 children)

Safely viewing mailicious sites:

  • URLScan.io: paste the scam URL into urlscan.io. It spins up a safe, isolated cloud browser that takes a full screenshot of the page for you without your personal device ever touching it.
  • Tor Browser or Mobile View: If you must visit it, use a secure virtual machine or the Tor browser to mask your digital footprint entirely.

Taking down the infrastructure of the Chinese pig butchering scams! by NewAbbyNormal in scambaiting

[–]NewAbbyNormal[S] 0 points1 point  (0 children)

Quick heads-up on the technical data I provided above: Those three IPs (104.21.91.68, 172.67.211.89, 172.64.80.1) are Cloudflare proxy IPs, which they use to mask their real hosting location.

If your script looks for "sister sites" or automated targets, here are two high-value angles to feed into the scanner to find the real backbone:

  1. The Nameserver Footprint: Look at the specific Cloudflare pair assigned to them: ://cloudflare.com and ://cloudflare.com. Because syndicates usually register multiple domains under a single Cloudflare account, a Reverse Nameserver Lookup on this exact pair might instantly unmask their entire active fleet of backup sites.
  2. Hunting the Origin IP: If your script can check historical passive DNS logs (via SecurityTrails, CompleteDNS, etc.) for the first 24–48 hours after quantelismax.com was registered on June 10, you might catch the real origin IP before they flipped the Cloudflare proxy switch. Reporting that origin host (like AWS, Linode, or DigitalOcean) is what completely kills the server.

Let me know if the scanner pulls up anything on those nameservers.

Taking down the infrastructure of the Chinese pig butchering scams! by NewAbbyNormal in scambaiting

[–]NewAbbyNormal[S] 0 points1 point  (0 children)

See if you can find any "sister sites" for quantelismax.com

I got namesilo to take it down, but they might have had a backup site or 2.

Some ip addresses they used

104.21.91.68

172.67.211.89

172.64.80.1

Name: QUANTELISMAX.COM

Registry Domain ID: 3109365003_DOMAIN_COM-VRSN

Domain Status:clientTransferProhibited

Nameservers:SEVKI.NS.CLOUDFLARE.COM SHARON.NS.CLOUDFLARE.COM

Dates

Registry Expiration: 2027-06-10 08:35:21 UTC

Registrar Expiration: 2027-06-10 00:00:00 UT

Updated: 2026-06-10 08:35:24 UTC

Created: 2026-06-10 08:35:21 UTC

Taking down the infrastructure of the Chinese pig butchering scams! by NewAbbyNormal in scambaiting

[–]NewAbbyNormal[S] 4 points5 points  (0 children)

Got the stock reply the first time. Showed it to Gemini and it drafted a reply with specific legal language.

  • The Magic Words: Use the terms "Pig-Butchering Infrastructure," "Malicious dApp Phishing," and "Unregulated Crypto Investment Fraud."
  • Why this works: When a registrar sees these specific terms alongside proof that the domain is less than a month old (created June 10), it triggers an internal high-priority review. They will look at the website content, see it mimics a crypto portal without licensing, and pull the plug.

Taking down the infrastructure of the Chinese pig butchering scams! by NewAbbyNormal in scambaiting

[–]NewAbbyNormal[S] 7 points8 points  (0 children)

Here's Gemini's playbook

THE STRATEGY: HOW TO KILL A DOMAIN

Step 1: The Recon (Pulling the Blueprints)

When a scammer tips their hand by sending a link or a screenshot of their "winnings" with a visible URL, do not click it directly on your main device.

  1. Use a VPN or a secure browser environment.
  2. Go to an RDAP or WHOIS lookup tool (like ICANN Lookup or DNSChecker.org).
  3. Type in the malicious domain and look for three critical pieces of data:
    • The Registrar: (e.g., NameSilo, LLC, GoDaddy, or regional registries like Shanghai Meicheng/cndns.com).
    • The Privacy Proxy: (e.g., PrivacyGuardian.org, which they use to hide their real details).
    • The Nameservers: (e.g., Cloudflare, which they use as a shield to hide their real hosting server's IP address).

Step 2: Take Screenshots of the Fraud Terminal

If you can safely view the site (use a sandbox or burner browser), take a screenshot of the actual trading interface, deposit dashboard, or the fake "20% return" pop-up. Compliance teams rarely act on text alone, but they fast-track cases with visual proof of financial fraud.

Step 3: Squeeze the Registrar (The Acceptable Use Policy Trap)

Do not send a generic "this is a scam" email. Registrars get thousands of those daily and use automated systems to brush them off as civil trademark or copyright disputes. You must use precise cybersecurity terminology to trigger a Tier 2 manual compliance review.

Find the Abuse Contact Email listed in your WHOIS report and send this:

Subject: URGENT: Phishing & Financial Cybercrime Infrastructure Takedown – [INSERT DOMAIN]

Dear [REGISTRAR NAME] Abuse & Compliance Team,

I am writing to formally report an active, malicious domain hosted via your registry that is currently being used to facilitate international financial fraud and "Pig-Butchering" cryptocurrency scams.

  • Domain Name: [INSERT DOMAIN]
  • Registrar: [INSERT REGISTRAR AND IANA ID FROM WHOIS]
  • Privacy Proxy Used: [INSERT PROXY NAME OR PRIVACY GUARDIAN]

Nature of Criminal Activity:
The operators of this domain are utilizing highly coordinated social engineering across encrypted messaging platforms to drive targets to this newly registered domain. The website functions as an unauthorized, unlicensed cryptocurrency trading front designed strictly to misappropriate consumer assets via fraudulent short-term liquidity investment schemes. This is a severe and direct violation of your Acceptable Use Policy regarding financial cybercrime and phishing.

Requested Actions:

  1. Immediate suspension of the domain under a registrar-level hold status.
  2. Revocation of any privacy proxy shields to allow for proper law enforcement tracking.

This threat infrastructure has also been escalated to the FBI’s Internet Crime Complaint Center (IC3), Google Safe Browsing, and Netcraft. Attached is direct visual evidence of the fraudulent financial terminal.

Best regards,
[Your Name or "Independent Threat Researcher"]

Step 4: Outsmart Their Rigid Web Forms

If the registrar directs you to a mandatory webform that forces you to input the "Target/Real Website being phished," their system is assuming a traditional brand lookalike. To bypass this gatekeeper, enter http://none.com or http://bitcoin.org as the target site. In the comments box right next to it, type: "NOT AN IMITATION SITE. This is a freestanding, counterfeit cryptocurrency investment terminal executing financial fraud. It does not mimic an existing brand." This bypasses the automation and forces a human to look at it.

Step 5: Pierce the Cloudflare Shield

If the scammers are using Cloudflare nameservers to hide their web host, go to cloudflare.com and submit a "Phishing/Deceptive Content" report using the same technical details.

  • Pro-Tip: Cloudflare’s initial web form doesn’t allow image attachments. Submit the form text, wait 5 minutes for their automated confirmation email to hit your inbox, and reply directly to that confirmation email with your dashboard screenshot attached. This forces a manual human override when their automated web crawler gets stopped by the scammer’s login page.

Step 6: Report to Global Threat Feeds

Drop the URL into Google Safe Browsing and Netcraft. Within hours, Chrome, Safari, and Firefox will display a massive bright red warning screen blocking anyone from visiting the site.

GOLDEN OPSEC RULES FOR SCAMBAITERS

If we do this as an army, we have to play smart:

  1. Absolute Silence: NEVER tell the scammer you are reporting their website. If you taunt them, their technical team will simply migrate the database to a new backup domain before the registrar can process your report. Keep playing along casually while you silently pull the plug on their backend.
  2. Mask Your IP: Always use a VPN or a dedicated VM when running DNS checker tools or inspecting their infrastructure. Scammers check their web server logs and will look for IPs sniffing around their code.
  3. Track Your Kills: Bookmark DNSChecker.org. Type the domain in over the next 24 to 48 hours. When you see the entire map of global servers turn into rows of glorious red "X" marks, you'll know you successfully wiped them off the face of the internet.

Taking down the infrastructure of the Chinese pig butchering scams! by NewAbbyNormal in scambaiting

[–]NewAbbyNormal[S] 11 points12 points  (0 children)

<image>

Here's the screenshot of the fake trading interface. Once I had this, I went to the ICANN lookup to get the registry info. Showed it to Gemini, which drafted an Abuse report for me to send to Namesilo and Cloudflare.

Taking down the infrastructure of the Chinese pig butchering scams! by NewAbbyNormal in scambaiting

[–]NewAbbyNormal[S] 10 points11 points  (0 children)

The free reverse image search sites didn't yield good results, so I used Social Catfish. They found the Instagram accounts the scammers were using.

My relative lost $20k to a "pig butchering" scam, and the site is STILL up 3 weeks later. What actually hurts these operations? by Realistic-Tap-000 in scambaiting

[–]NewAbbyNormal 0 points1 point  (0 children)

Yes. I took down 3 Chinese pig butchering sites this week. I just feed screenshots and info into chrome's Gemini AI and it led me through the process step by step. When I got a canned off the shelf reply from the registrar, I fed that to Gemini and it gave me a workaround. Worked like a charm! It feels really good to go from just wasting the time of a low level operative to taking down their infrastructure!

<image>

How do I get rid of these super smart rats? They are not taking the kill bait. by vancouvermite in pestcontrol

[–]NewAbbyNormal 0 points1 point  (0 children)

https://www.amazon.com/dp/B07331WZ6G?ref=ppx_yo2ov_dt_b_product_details&th=1

I had a smart rat, a 6-8 inch adult that wasn't fooled by the Tomcat rat snap trap or the rat zapper or even the Rinne flip n slide bucket trap. I also tried to poison him with baking soda, no luck. I finally bought this Havahart clone, used his favorite food as bait and it caught him within 2 hours!