Cyber Crime: Mission Domain Intelligence Guide

A single business email compromise crew does not need malware. It needs a lookalike domain registered on a Tuesday, a mailbox rule, and a mule account that has existed just long enough to look ordinary.

What Cyber Crime covers as a mission domain

Cyber crime intelligence covers financially motivated offending conducted through or against computer systems: business email compromise and invoice fraud, phishing and credential theft, account takeover, card fraud, investment and romance fraud, and the service economy that supports them. Analysts work outward from victim loss to infrastructure, from infrastructure to the service providers who rent it, and from proceeds to the cash-out layer. The distinguishing feature is a market: roles are specialised and rented, so the person who gains access is rarely the person who monetises it.

The ecosystem separates into access provision (initial access brokers, loader operators, credential sellers), enablement (bulletproof hosting, anti-detect browsers, phishing-as-a-service kits, SMS gateways, SIM swap insiders), monetisation (mule networks, cash-out crews, crypto exchange abuse) and dispute infrastructure (forums, escrow, reputation). Mapping who supplies whom often yields better disruption points than pursuing individual campaigns.

Why it matters

Reported losses run to tens of billions annually and reported cases are a fraction of the total. The harm distribution is skewed toward those least able to absorb it: small firms wiped out by a single redirected payment, older victims of romance and investment fraud losing pensions, and money mules, often students or migrants, who acquire criminal records for a role they did not understand.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Newly registered domains one character from a real brand, with mail exchange records and a TLS certificate added within hours of creation
Mailbox forwarding or inbox rules created shortly before a payment instruction changes, often filtering the supplier's own name
Clusters of bank accounts opened from the same device fingerprint or IP range, dormant, then receiving structured inbound transfers
Phishing kits whose exfiltration endpoint, favicon hash or unique JavaScript variable names recur across hundreds of unrelated sites
Cash-out chains where funds pass through a fixed set of exchange deposit addresses within minutes of victim payment
Advertisements recruiting for payment processing or parcel reshipping with implausible commission and no employer identity
Support telephony reusing the same voice-over-IP provider prefixes across multiple fraudulent brands and callback scripts
Reused registrant email hashes, hosting autonomous systems or nameservers linking campaigns that appear unrelated at the domain level

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

FBI IC3 annual reports — Reported complaint volumes, loss figures by fraud type and demographic breakdowns useful for baselining
Europol IOCTA — European law enforcement assessment of criminal service markets, trends and disruption outcomes
APWG phishing activity trends — Quarterly phishing volume, targeted sector distribution, hosting patterns and reported trends in attack technique
abuse.ch (URLhaus, ThreatFox, MalwareBazaar) — Community feeds of malicious URLs, indicators and samples with first-seen timestamps
Spamhaus and SURBL — Reputation data on hosting, autonomous systems and domains for infrastructure pivoting
ICANN RDAP and certificate transparency logs — Registration and certificate issuance timing that dates infrastructure and links campaigns
Action Fraud, national reporting centres and FinCEN advisories — Typologies, red flag lists and jurisdiction-specific reporting routes for victims
Public blockchain explorers and exchange sanctions notices — Traceable on-chain movement and designated cash-out services for proceeds analysis

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Reconstruct the victim event — Establish the loss mechanism precisely: which instruction changed, which credential was used, and the exact timeline of transactions.
Pivot the infrastructure — Move from the observed domain or URL to registration, certificate, hosting and kit artefacts to find sibling campaigns.
Trace the money — Follow the payment through beneficiary accounts, payment processors or on-chain hops to the first point of consolidation.
Resolve personas — Correlate handles, contact addresses and advertising copy across forums and messaging channels, tracking confidence per link.
Identify the service layer — Determine which kit, hosting provider or mule network is shared across cases, since that is the disruptive chokepoint.
Package for action — Deliver a referral with preserved evidence, exhibit list and jurisdictional analysis, plus takedown requests where recovery windows still exist.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

Cyber Intelligence — Adversary Activity in Networks and Systems
Criminal Intelligence — Intelligence Supporting Criminal Investigation
Threat Actor Intelligence — Tracking Adversary Groups Over Time
Dark Web Intelligence — Hidden Services and Closed Criminal Venues
Breach Intelligence — Exposed Credentials and Compromised Data
Financial Intelligence — Following Value Through the Financial System
Cryptocurrency Intelligence — Tracing Value on Public Ledgers

Worked in these data points

IP Address — Internet Protocol address identifying a device or server on a network.
Domain Name — Human-readable address that maps to IP infrastructure via DNS.
URL — Uniform Resource Locator pointing to a web resource.
Email Address — Electronic mail address tied to an individual or organization.
Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
Password / Credential — An exposed password or credential pair from leaks or dumps.
Data Breach — A known data breach or leak incident with exposed records.
Onion / Hidden Service — A Tor hidden service address on the dark web.

Adjacent mission domains

Inside the platform: where Cyber Crime lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

ioc.php — Cyber Crime dashboard
domain.php?d=cc — Mission domain hub
theater.php?d=cc — Threat theater view
ip-profile.php — IP Address profile
url-profile.php — Domain Name profile
email-profile.php — Email Address profile
blockchain.php — Cryptocurrency Address profile
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Cyber Crime:

Phishing Investigation & Takedown — a step-checked workflow with the pivots, sources and handling rules already wired in.
Breach & Credential Exposure — a step-checked workflow with the pivots, sources and handling rules already wired in.
Cryptocurrency Tracing — a step-checked workflow with the pivots, sources and handling rules already wired in.
Malware Triage — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Correlate Infrastructure
Run Alert Rules
Detection Rules
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Reconstruct the victim event is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Trace the money turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Package for action feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Cyber Crime

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence organisations meet cyber crime mainly as a force protection and integrity problem: payroll and vendor fraud against defence suppliers, credential theft affecting personnel and their families, and criminal access brokers selling footholds into contractors that also serve state actors. The analytic value is in distinguishing criminal opportunism from state tasking early, because the response differs. Products feed counterintelligence briefings, supplier assurance and personnel security awareness. Constraints include the limits on collecting against private individuals, the requirement to route criminal matters to civil police or military police rather than pursuing them internally, and careful handling of personal data belonging to service members and dependants.

🕵 National intelligence

National agencies track cyber crime because the ecosystem overlaps with state activity: shared access brokers, shared bulletproof hosting, contractors moonlighting and states tolerating groups that serve their interests. Collection is requirements driven against the service layer rather than individual frauds, focusing on infrastructure providers, laundering networks and the small number of individuals whose removal degrades many operations. Fusion of financial intelligence, technical telemetry and human reporting is where the value sits. Handling considerations include sharing with law enforcement without contaminating an evidential chain, and protecting sensitive collection when a disruption option would expose it. Success is measured in disruption effects rather than reporting volume.

👮 Law enforcement

This is core law enforcement territory. The evidential requirement drives everything: preserved logs obtained under production orders, subscriber and payment records, seized devices imaged with documented custody, and financial records traced across institutions. Cross border cases need mutual legal assistance or the emergency and preservation routes available under international instruments, which take time, so preservation requests go out early. Charging decisions turn on identifying a natural person behind an account, proving the mental element and quantifying loss. Investigators increasingly work the money and the mule network, because that produces attributable individuals and restraint opportunities faster than pursuing pseudonymous infrastructure alone.

🔍 Private investigation and corporate security

Corporate investigators handle fraud response, recovery, insurance support and internal accountability. Typical products are a reconstructed payment chain, a compromise timeline supporting an insurance claim, and evidence packages handed to police and to receiving banks for recall. A private actor may not access accounts, impersonate victims or officials to obtain records, deploy trackers, or run intrusive surveillance on suspects. Recovery works through lawful channels: bank fraud teams, payment scheme processes, civil freezing orders and court disclosure. The discipline that matters is speed with documentation, because funds move within hours but a poorly evidenced recall request will be refused.

📰 Journalism and OSINT media

Reporting on fraud requires care with victims and precision with numbers. Loss figures circulating publicly are often self reported, extrapolated or double counted, so state the basis of any figure used. Verification means corroborating a scheme through multiple independent victims, documentary evidence such as payment records, and where possible technical artefacts. Victims of romance and investment fraud carry shame and are frequently re-targeted by recovery scams, so consent, anonymity options and a clear explanation of publication consequences are essential. Naming suspects requires legal review, and right of reply applies to platforms and banks whose systems are criticised as well as to individuals.

🌍 NGO, humanitarian and human rights

Consumer protection, victim support and anti fraud charities work with people who have lost savings, housing or relationships. Practice is trauma informed: fraud victims routinely blame themselves and disclosure is difficult, so intake should avoid interrogation framing. Data about victims is sensitive personal data and must be minimised, consented and protected, particularly because recovery fraud operators target victim lists. Aggregate documentation supports policy work on payment protections and platform accountability. Duty of care extends to caseworkers, who absorb significant distress. Where a case involves coerced money mules or trafficked scam centre workers, treat the person as a potential victim and use the appropriate referral route.

🎓 University and research

Research questions range from victimisation prevalence to the economics of criminal services. Methodology matters because convenience samples of reported fraud badly misrepresent the population: reporting rates are low and skewed by age, loss size and channel. Prefer population surveys with published instruments, and document how cases were classified because typologies differ between jurisdictions. Ethics approval is required for victim interviews and for any collection from criminal forums, and researchers should never purchase criminal services to study them. Share coding frames and analysis code, publish negative results, and archive volatile web sources, since forums and marketplaces disappear without notice.

Playbook: working Cyber Crime end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Take the report and stabilise the loss

Capture the essentials fast: what was sent, to which account or wallet, when, through which channel, and who authorised it. Trigger recall or freezing requests to the sending institution immediately, because the practical window is hours. Simultaneously preserve mailboxes, device state and platform records before automated retention deletes them. A good output within the first hours is a preserved evidence set plus an initiated recall reference, not a completed analysis.

Phase 2 — Reconstruct the compromise vector

Establish how the fraud was enabled: mailbox compromise, thread hijack, spoofed domain, invoice interception, credential stuffing or social engineering by phone. Examine mail rules, forwarding, OAuth grants and sign in logs for the relevant period. Distinguish compromise of your estate from compromise of a counterparty, because the remediation and the liability both change. The output names the vector with evidence, or states clearly that the evidence does not support a determination.

Phase 3 — Map the receiving chain

Follow the funds through the first receiving account, onward transfers, mule layers and cash out points. For cryptocurrency, trace on chain to exchange deposit addresses and identify services that respond to law enforcement. Record every hop with timestamps and amounts. A good output is a chain diagram that a bank fraud team or a police financial investigator can act on directly, with the points where funds are still recoverable marked.

Phase 4 — Cluster the infrastructure

Pivot on registration patterns, hosting, phishing kit artefacts, mail headers, TLS certificates and reused templates to link the incident to a wider campaign. Kit reuse and panel fingerprints are often more durable than domains. The value is showing that a single victim event belongs to a series, which changes the response from an isolated loss to a disruption target and justifies escalation to law enforcement or a platform.

Phase 5 — Identify the human layer

Look for the natural persons: mule account holders, registrants who reused a personal email, phone numbers reused across kits, and operational security failures on criminal forums. Keep this within legal bounds and document the lawful source of each identifier. The output is a set of leads suitable for handing to law enforcement, not an attempt to confront or expose an individual, which is unlawful and prejudices any prosecution.

Phase 6 — Assess whether the mules are victims

A significant share of mule account holders are coerced, recruited through fake job adverts or themselves trafficked into scam compounds. Screen for indicators of coercion and debt bondage before treating an account holder as an offender, and route suspected victims to the appropriate national referral or support mechanism. This assessment protects individuals and also prevents an investigation from collapsing when a defendant is later recognised as a victim.

Phase 7 — Package for evidential use

Convert the working analysis into an exhibit set: preserved originals with hashes, a custody log, statements describing collection method, and an analysis note that separates observation from inference. Anticipate challenge on how open source material was captured and preserved. A good package can be handed to a prosecutor without a second round of collection and can be understood by someone with no technical background.

Phase 8 — Coordinate disruption

Work the parallel routes: registrar and hosting abuse for phishing infrastructure, platform takedowns for fraudulent adverts and accounts, bank alerts on mule accounts, and exchange notifications for wallet addresses. Sequence them so a takedown does not destroy evidence or alert an actor before a policing action. Record what each provider did and how long it took, because that data drives later pressure on the slow ones.

Phase 9 — Notify and support victims

Tell affected parties what happened in plain language, what data was exposed and what practical steps reduce further harm. Warn explicitly about recovery fraud, because victim lists circulate and second approaches are common. Where regulatory notification applies, run that clock in parallel with counsel. Support quality matters: a victim who feels blamed will not report the follow up attempt, and that follow up is often the better investigative lead.

Phase 10 — Feed prevention back

Convert findings into controls: payment verification procedures that do not rely on email, supplier bank detail change processes with out of band confirmation, phishing resistant authentication and monitoring for lookalike domain registration. Test the control against the actual scenario that succeeded. A good output is a change that would have stopped this incident, implemented and verified, rather than an awareness message.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
IC3 Internet Crime Complaint Center	Open	United States public complaint intake plus annual reporting on fraud types, losses and demographics.	Baseline for scheme prevalence and the reporting route for United States victims and loss recovery.
Action Fraud and NFIB	Open	United Kingdom national fraud and cyber crime reporting centre with published trend data.	Reporting route for UK victims and a source for national level scheme prevalence.
Europol IOCTA and threat assessments	Open	European strategic assessments of cyber dependent and cyber enabled crime and criminal service ecosystems.	Strategic framing and typology definitions when briefing non technical decision makers. Also defines the criminal service categories used across Europe.
URLhaus	Open	Open database of malicious URLs used for malware distribution, with payload and host detail.	Checking whether a phishing or delivery host is part of a known campaign cluster.
PhishTank and OpenPhish	Registration	Community and automated phishing URL feeds with verification status and target brand.	Identifying kit reuse and brand targeting patterns across a phishing campaign. Verification status matters, since unverified submissions are frequently wrong.
Certificate transparency search	Open	Public logs of issued TLS certificates including subject names and issuance timestamps.	Detecting lookalike domain registration against a protected brand before it is weaponised.
Have I Been Pwned	Open	Index of credentials and accounts exposed in publicly known breaches, with domain level search for owners.	Establishing whether compromised credentials plausibly enabled an account takeover. Domain level search requires proof of ownership of the domain.
Blockchain explorers and analytics platforms	Licensed	Transaction graphs, address clustering and service attribution for major cryptocurrencies. Coverage includes exchange attribution and sanctioned address labelling.	Tracing proceeds to exchange deposit addresses that can be served with legal process.
Interbank recall and payment scheme fraud processes	Licensed	Interbank recall, indemnity and fraud reporting mechanisms operated through financial institutions and national payment systems. Access runs through the victim's own bank rather than directly.	Initiating recall of misdirected payments within the window where funds remain recoverable.
FinCEN advisories	Open	United States financial crime advisories describing fraud typologies and red flag indicators for institutions.	Aligning internal detection rules with recognised typologies and supporting suspicious activity reporting.
APWG phishing activity reports	Open	Aggregated phishing volume, targeted sector and hosting trend data contributed by industry members.	Benchmarking observed campaign activity against sector wide trends. Useful for showing a board whether exposure is sector wide.
Registrar and hosting abuse channels	Open	Published abuse contacts and reporting procedures for domain registrars, registries and hosting providers.	Requesting suspension of phishing domains and documenting provider response times. Provider response times become evidence for later escalation.
Spamhaus datasets	Registration	Reputation data on domains, IP ranges and networks associated with abuse and criminal hosting.	Assessing whether infrastructure sits in a network with a persistent abuse history.
No More Ransom and law enforcement prevention portals	Open	Public guidance and tooling produced jointly by police and industry for victims of cyber enabled crime.	Directing victims to authoritative guidance rather than commercial recovery operators. Also lists free decryptors produced through police and industry work.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Cyber Crime. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

Mail header and message trace analysis — Reconstructs delivery path, authentication results and thread hijack points. Limitation: headers can be forged, and cloud trace retention is often shorter than the investigation.
Blockchain tracing platforms — Cluster addresses and attribute services to support asset tracing. Limitation: attribution is probabilistic, and mixing or cross chain bridges break the visible chain.
Domain monitoring and typosquat detection — Alerts on lookalike registrations against protected brands. Limitation: high false positive volume and no coverage of compromised legitimate sites.
Phishing kit analysis tooling — Extracts exfiltration endpoints, author artefacts and template lineage from recovered kits. Limitation: requires lawful acquisition of the kit and kits are frequently reused across unrelated actors.
Case management with exhibit registers — Tracks evidence, custody and disclosure across a multi victim investigation. Limitation: only as reliable as the discipline of the people entering records.
Link analysis software — Visualises relationships between accounts, identifiers and transactions. Limitation: visual density can imply certainty that the underlying evidence does not support.
Web capture with hashing — Preserves fraudulent adverts, storefronts and profiles in a defensible form before removal. Limitation: dynamic and personalised content may not reproduce for another examiner.
Bulk data reconciliation in spreadsheets or notebooks — Matches payments, invoices and account records across systems to quantify loss. Limitation: transformation steps must be documented or the resulting figures are not defensible.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
Detection Rules — Generates YARA, Sigma and Snort/Suricata logic from the selected indicators, ready to deploy.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Money moves faster than analysis. The first hour should be spent on recall requests, preservation notices and freezing, not on understanding the intrusion, because the analytical picture will still be available tomorrow and the funds will not.
Most business email compromise involves no malware at all. Analysts trained to hunt binaries routinely miss a mailbox rule, an OAuth consent and a lookalike domain, which together explain the whole case.
Treat mule account holders as unresolved status rather than offenders until screened. Coerced recruits and trafficked scam centre workers appear in these chains constantly, and misclassifying them is both a safeguarding failure and a litigation risk.
Kit and panel artefacts outlive domains. Fingerprinting the phishing kit build, its exfiltration method and its template lineage links campaigns across months where infrastructure indicators link nothing.
Self reported loss figures are not measurements. Establish whether a number is attempted or actual, gross or net of recovery, and whether it double counts the same funds at multiple hops before it enters a briefing.
The second approach is the better lead. Victims are re-targeted by recovery fraud operators using leaked victim lists, and that follow up contact is usually fresher and more attributable than the original scheme.
Prevention should be tested against the specific scenario that succeeded. A supplier bank detail change process that still permits email confirmation has not been fixed, whatever the awareness training says.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Cyber Crime is producing anything, and they are worth baselining before you change process or tooling.

Proportion of reported losses recovered or frozen, split by channel and by time from payment to recall request.
Median time from victim report to preservation request and to recall initiation, measured in hours.
Share of incidents where the compromise vector was determined with documentary evidence rather than assumed.
Takedown latency by provider for confirmed phishing infrastructure, tracked to hold slow providers accountable. Repeat abuse by the same provider matters more than individual compliance.
Rate of repeat victimisation among reported victims, which measures whether support and warning actually worked.
Number of cases handed to law enforcement that reach charge or restraint, rather than referrals made.
Reduction in successful payment diversion after out of band verification controls are implemented, measured against attempted events.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Assuming one actor behind a phishing kit when the same kit is resold to dozens of unrelated operators
Confusing a reseller or affiliate with the developer, and attributing the whole campaign to whoever is loudest on a forum
Over-reading redacted registration data post-privacy-rules, where empty fields reflect policy rather than deliberate concealment
Double-counting losses when a victim reports to a bank, a national centre and a regulator, inflating apparent campaign scale
Chasing indicators with no loss context, producing large lists that no investigator can prioritise or act on
Missing the recovery window: the first hours after a fraudulent transfer matter more than a perfect attribution later

Legal and ethical considerations

Fraud investigation touches regulated financial data, so obtain account information through lawful process rather than informal contacts. Do not access attacker-controlled panels or open directories that require credentials, however weak; that is unauthorised access in most jurisdictions and can taint the case. Preserve headers, logs and transaction records with hashes and time sources for admissibility. Cross-border referrals usually require mutual legal assistance, so identify the controlling jurisdiction early, and treat victim identities as personal data with restricted onward disclosure.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Cyber Crime, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 7 intelligence disciplines, 8 data points, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

What actually recovers money after a misdirected payment?

Speed through formal channels. Contact the sending bank immediately to request recall and ask them to contact the beneficiary institution; in many jurisdictions there is a rapid response mechanism between banks. Report to the national fraud reporting body so a reference exists. If funds moved to cryptocurrency, notify the receiving exchange with the transaction detail, since compliant exchanges can freeze deposits. Everything after roughly seventy two hours has sharply reduced odds. Avoid commercial recovery agents who cold contact victims, which is itself a common second stage fraud.

How do we tell criminal activity from state activity when they look identical?

Look at what happened after access. Criminal operators monetise: they exfiltrate data with resale value, deploy extortion, or pivot to payment systems, usually within days. State operators collect selectively and persist quietly, often ignoring obvious financial opportunities. Tooling overlaps because both buy from the same access brokers, so tooling alone will not separate them. Targeting also helps: criminal victim sets are broad and opportunistic, state sets are narrow and policy aligned. Where the picture is genuinely ambiguous, report it as ambiguous rather than defaulting to the more dramatic explanation.

Can we hack back or take down criminal infrastructure ourselves?

No. Accessing systems you do not own is a criminal offence in essentially every relevant jurisdiction, and the excuse of good motive is not a defence. It also destroys evidence, tips off the operator and can disrupt a live law enforcement operation you cannot see. The lawful routes are registrar and hosting abuse reporting, platform trust and safety escalation, notification to exchanges and banks, and referral to police or a national cyber authority. Document each request and the response time; that record has more long term value than an unlawful shortcut.

How should we handle a suspected money mule who works for us?

Treat it as both a conduct matter and a potential safeguarding matter. Suspend access to relevant systems and preserve records, but screen for coercion indicators before concluding intent: recruitment through a job advert, debt to a third party, threats to family, or documents held by someone else. If coercion indicators are present, route through the appropriate national referral mechanism for potential victims rather than straight to dismissal. Take legal advice on reporting obligations, and do not conduct an accusatory interview before that advice, because it can compromise both the criminal case and the employment position.

Is it worth reporting small frauds to police?

Yes, because aggregation is what creates cases. Individual losses below a policing threshold routinely combine into large series once a reporting body links them by account, domain or kit artefact. Reporting also establishes the record needed for insurance, regulatory notification and civil recovery. Provide structured detail: timestamps, account numbers, wallet addresses, domains and preserved evidence, since a well evidenced small report is more useful to an analyst than a vague large one. Track your own reference numbers, because they become the thread that links your case to a wider operation.

Why do the same phishing kits keep reappearing after takedowns?

Because takedown removes a domain, not the operator, the kit or the hosting relationship. Kits are commodity products sold with support, deployed within minutes on new infrastructure, and often hosted on compromised legitimate sites that get cleaned and reinfected. Sustainable reduction comes from targeting the layers that are harder to replace: the exfiltration endpoint, the payment collection method, the resale forum account and the small number of providers who tolerate abuse. Measure providers on repeat abuse rather than on individual takedown compliance, and escalate the persistent ones.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

Budapest Convention on Cybercrime, which provides preservation, production and mutual legal assistance mechanisms for cross border cyber crime.
ISO/IEC 27037, governing identification, collection and preservation of digital evidence to an admissible standard.
ACPO or equivalent national digital evidence principles, requiring that original data is not altered and that actions are auditable.
FATF Recommendations, particularly on wire transfers, virtual asset service providers and suspicious transaction reporting.
PCI DSS, which governs handling of payment card data and shapes what card related evidence an organisation may retain.
General Data Protection Regulation and equivalent regimes, which set the lawful basis, minimisation and retention rules for victim and suspect data.
Payment Services Regulations and national authorised push payment reimbursement rules, which determine liability for misdirected payments.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Internet Crime Report — FBI Internet Crime Complaint Center. Annual statistics on reported cyber enabled fraud types and losses.
Internet Organised Crime Threat Assessment — Europol. Strategic assessment of cyber crime services, actors and trends in Europe.
FATF Recommendations — Financial Action Task Force. International standards on anti money laundering and terrorist financing.
URLhaus malicious URL database — abuse.ch. Open dataset of malware distribution and phishing URLs.
Have I Been Pwned breach index — Have I Been Pwned. Searchable index of credentials exposed in known data breaches.
Phishing Activity Trends Reports — Anti-Phishing Working Group. Industry contributed data on phishing volumes and targeted sectors.
Advisories on fraud typologies — Financial Crimes Enforcement Network. Regulatory advisories describing fraud red flags for financial institutions.
No More Ransom victim guidance — Europol, Dutch National Police and industry partners. Public prevention and recovery guidance for cyber crime victims.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: links fraud infrastructure, phishing kit reuse and mule cash-out patterns back to individual victim losses. Explore the platform, or browse the rest of the library by following any tag above.