0xBADCAFE
ResearchTracksAboutRSS

Submit a lure

Seen something bitter?

A fake CAPTCHA, a poisoned search result, a recruiter who's a little too keen to get you on a call. Send it over.

What helps

  • Screenshots of the page or message
  • The URL, defanged: hxxps://evil[.]example/
  • The original email as an attachment (.eml), headers intact
  • The search query or ad that led you there
  • Roughly when you saw it

Don't run anything it asks you to, and don't send live payloads by email. If you have a sample, ask first and we'll arrange a safe transfer. Research collaboration and disclosure go to the same address.