# CybrCrime.com

> CybrCrime.com is a community threat-intelligence project that tracks the infrastructure of the cybercrime economy (scam sites, money-mule wallets, infostealer servers, phishing kits, bulletproof hosting, ransomware leak sites and more) and shares it with defenders through one schema and API. It also runs the CybrCrime Arcade, a free, game-style course that trains new defenders. The project is in an invite-only beta.

Key facts:
- 12 tracker projects in three areas: delivery infrastructure, fraud and monetisation, underground services.
- Shared services: DetectHub (detection rules mapped to MITRE ATT&CK) and the Intel Library (plain-language encyclopedia).
- Level 0 of the Arcade, Cyber Security Essentials, is free and open to anyone: 8 sections, 40 lessons, 50 real-world cases, about 24 hours.
- Two ways to full access: the training path (complete training and get contributions accepted) or professional review by the Site Review team.
- Only TLP:CLEAR aggregate statistics are public. No malware, phishing kits, working exploits or stolen credentials are hosted.

## Pages
- [Home](https://cybrcrime.com/): what CybrCrime.com is and who it is for
- [Projects](https://cybrcrime.com/projects/): the twelve trackers and what each covers
- [How it works](https://cybrcrime.com/how-it-works/): the intel pipeline, house rules and the Arcade
- [Access](https://cybrcrime.com/access/): invite-only beta, two ways in, access tiers
- [Apply](https://cybrcrime.com/apply/): how to create an account and request access
- [Intel Library](https://cybrcrime.com/library): cybercrime terms explained in plain language

## Projects
- [StealerGate Tracker](https://cybrcrime.com/projects/#stealergate): Command-and-control panels, configuration servers and data-drop gates used by infostealers such as Lumma, RedLine and StealC.
- [PhishKit Bazaar](https://cybrcrime.com/projects/#phishkit-bazaar): Phishing kit hashes, template versions and logo fingerprints. Kit files themselves are never hosted.
- [Crypto Tracker](https://cybrcrime.com/projects/#crypto-tracker): Crypto-drainer browser extensions, rogue web apps and clipboard hijackers that swap wallet addresses.
- [MalAdvert](https://cybrcrime.com/projects/#maladvert): Abused ad accounts, advertiser IDs and cloaked landing pages behind malvertising and search poisoning.
- [RansomFeed](https://cybrcrime.com/projects/#ransomfeed): Ransomware leak sites, victim claims and the life cycle of extortion groups.
- [MuleNode](https://cybrcrime.com/projects/#mulenode): Crypto wallets, money-mule bank accounts and payout nodes, tagged by role.
- [ScamHost](https://cybrcrime.com/projects/#scamhost): Tech-support scams, fake shops and investment (pig-butchering) sites, with screenshots and hosting details.
- [ScammerID](https://cybrcrime.com/projects/#scammerid): Aliases and handles linked to scam operations, published only under an evidence standard with a dispute process.
- [BotMarket Tracker](https://cybrcrime.com/projects/#botmarket): Log markets and channels selling stolen sessions. Domains and metadata only, never victim credentials.
- [BulletProof Radar](https://cybrcrime.com/projects/#bulletproof-radar): Bulletproof hosting providers, rogue networks (ASNs) and repeat-offender shell companies.
- [ExploitBazaar](https://cybrcrime.com/projects/#exploitbazaar): Exploited vulnerabilities mapped to CVE and the CISA Known Exploited Vulnerabilities list. Links and metadata only.
- [CredRouter](https://cybrcrime.com/projects/#credrouter): Residential proxy networks and credential-stuffing gateways.
- [DetectHub](https://cybrcrime.com/projects/#detecthub): Hunting hypotheses and detection rules in Sigma, YARA, KQL and SPL, mapped to MITRE ATT&CK and peer reviewed.
- [Intel Library](https://cybrcrime.com/projects/#intel-library): A plain-language encyclopedia of cybercrime terms, plus vendor and government reporting.