Twelve trackers, one platform.
CybrCrime.com runs twelve tracker projects in three areas: delivery infrastructure, fraud and monetisation, and underground services. All of them share one JSON schema and one API. Two shared services sit on top: DetectHub for detection rules and the Intel Library for reference. StealerGate Tracker, MuleNode and ScamHost open first.
Delivery infrastructure
How victims get compromised
StealerGate Tracker
Tracks: Command-and-control panels, configuration servers and data-drop gates used by infostealers such as Lumma, RedLine and StealC.
Used for: Blocking stealer traffic and spotting infected machines early.
PhishKit Bazaar
Tracks: Phishing kit hashes, template versions and logo fingerprints. Kit files themselves are never hosted.
Used for: Linking phishing sites to the kit and the seller behind them.
Crypto Tracker
Tracks: Crypto-drainer browser extensions, rogue web apps and clipboard hijackers that swap wallet addresses.
Used for: Warning users and wallets before funds are drained.
MalAdvert
Tracks: Abused ad accounts, advertiser IDs and cloaked landing pages behind malvertising and search poisoning.
Used for: Reporting bad ads and blocking fake download pages.
Fraud and monetisation
Scams, extortion and cash-out
RansomFeed
Tracks: Ransomware leak sites, victim claims and the life cycle of extortion groups.
Used for: Early warning for suppliers and sector-wide visibility.
MuleNode
Tracks: Crypto wallets, money-mule bank accounts and payout nodes, tagged by role.
Used for: Transaction screening by banks, fintechs and exchanges.
ScamHost
Tracks: Tech-support scams, fake shops and investment (pig-butchering) sites, with screenshots and hosting details.
Used for: Fast takedown requests to registrars and hosts.
ScammerID
Tracks: Aliases and handles linked to scam operations, published only under an evidence standard with a dispute process.
Used for: Investigations that need to connect campaigns to operators.
Underground services
Markets, hosting and attack tooling
BotMarket Tracker
Tracks: Log markets and channels selling stolen sessions. Domains and metadata only, never victim credentials.
Used for: Alerting organisations whose staff logs are for sale.
BulletProof Radar
Tracks: Bulletproof hosting providers, rogue networks (ASNs) and repeat-offender shell companies.
Used for: Network reputation scoring and abuse escalation.
ExploitBazaar
Tracks: Exploited vulnerabilities mapped to CVE and the CISA Known Exploited Vulnerabilities list. Links and metadata only.
Used for: Patching what attackers actually use first.
CredRouter
Tracks: Residential proxy networks and credential-stuffing gateways.
Used for: WAF and login-protection blocklists.
Shared by every project
Platform services
DetectHub
Tracks: Hunting hypotheses and detection rules in Sigma, YARA, KQL and SPL, mapped to MITRE ATT&CK and peer reviewed.
Used for: Turning intelligence into detections.
Intel Library
Tracks: A plain-language encyclopedia of cybercrime terms, plus vendor and government reporting.
Used for: Learning and quick reference.
How do the trackers connect?
Routing rules link related records across projects. Stealer command-and-control findings in StealerGate Tracker feed BotMarket Tracker, because stolen logs end up for sale. Wallets found in drainer code by Crypto Tracker feed MuleNode, because that is where the money goes next. Every indicator also has one page that shows everything known about it across all twelve trackers.
What will CybrCrime.com never host?
- Malware samples, phishing kit files or working exploit code
- Stolen credentials, session cookies or victim data
- Named people without evidence, a confidence level and a dispute path
Last updated by CybrCrime.com