Independent online safety intelligence

Exposing digital threats. Protecting people.

Ghost Six is an independent online safety watch group. We investigate cybercriminal networks, fraudulent operations, and hostile digital infrastructure using verified community intelligence.

Submit a tip anonymously View active reports

Current brief

Active files04

Verified03

Signals logged513

Threat levelElevated

Search intelligence database

Threat classification

Record type

Evidence strength

Law-enforcement referral

Sort results

04 records located

Active case files

Information is published only after multi-source verification

Evidence grade methodology

Grades describe the strength and corroboration of evidence currently available to Ghost Six. They are not court findings, legal determinations, or proof that a named person or account has committed an offence.

E1Unverified allegation

E2Limited supporting material

E3Consistent evidence; review ongoing

E4Corroborated by independent sources

E5Strong multi-source evidence

GS-0601

Phantom Pay

Confirmed threat

Organized payment fraud targeting e-commerce shoppers with spoofed invoices and cloned checkout infrastructure.

WebsiteEmailPhishing

Signals147 reports

Opened08 MAR 2025

View findings and conclusion

Linked records

Websitephantom-pay.example

Emailbilling@phantom-pay.example

Current conclusion

Multiple independent reports describe the same invoice template and cloned payment flow. The infrastructure should be treated as fraudulent; do not enter payment or identity information.

Assessment confidence: High

GS-0602

DarkHarvest

Confirmed threat

Illicit marketplace facilitating stolen credential sales, doxxing services, and bulk personal-data distribution.

WebsiteX accountPerson

Signals089 reports

Opened19 NOV 2024

View findings and conclusion

Linked records

Websitedarkharvest.example

X account@darkharvest_example

PersonAlias: “Harvester”

Current conclusion

Observed listings and corroborating victim reports indicate trade in compromised personal information. Do not contact the operator or attempt to access restricted infrastructure.

Assessment confidence: High

GS-0603

ShadowBank

Under review

Fraudulent crypto investment network using fabricated returns, false endorsements, and locked-withdrawal schemes.

WebsiteFacebookEmail

Signals214 reports

Opened01 JUN 2025

View findings and conclusion

Linked records

Websiteshadowbank.example

FacebookShadowBank Investment Group

Emailsupport@shadowbank.example

Current conclusion

Reports consistently describe blocked withdrawals and demands for additional fees. The case remains under review, but users should avoid sending funds or identity documents.

Assessment confidence: Medium

GS-0604

VoiceClone

Confirmed threat

AI voice impersonation operation targeting families and officials through phone calls and encrypted messaging channels.

PhoneEmailPerson

Signals063 reports

Opened22 MAY 2025

View findings and conclusion

Linked records

Phone+44 1632 960123

Emailalerts@voiceclone.example

PersonMultiple impersonated identities

Current conclusion

The reported calls use urgency, familiar voices, and requests for secrecy or immediate payment. Verify unexpected requests through a separate trusted channel before taking action.

Assessment confidence: High

No intelligence records match the current parameters.

Report information safely

Send only information you are legally permitted to share. Never put yourself at risk, confront a suspected offender, or access illegal material to gather evidence.

01 / PREPARE

Record what you observed

Include relevant names, dates, URLs, usernames, and a clear description of what happened.

02 / PROTECT

Remove personal details

Check screenshots and documents for names, addresses, account numbers, or location data.

03 / SUBMIT

Send the report securely

Use the anonymous reporting route. If anyone is in immediate danger, contact emergency services.

How Ghost Six works

We collect public-interest reports, compare submissions with open-source information, and publish findings only when the available evidence supports them. A listing is not a substitute for a police report, legal advice, or an official regulatory finding.

01 / INDEPENDENCE

No government affiliation

Ghost Six is an independent watch group and does not represent an intelligence service, police force, or regulator.

02 / VERIFICATION

Evidence before publication

We look for corroborating reports, consistent indicators, and reliable public records before describing a threat as confirmed.

03 / MINIMISATION

Protecting personal information

Reports should contain only what is relevant. Unnecessary identifying information should be removed before submission.

From signal to referral

Our process

Every case follows the same documented path. The strength of the conclusion depends on the quality, independence, and consistency of the evidence—not simply the number of submissions received.

Intake

Gather and triage evidence

We receive community reports, record the original source and time, remove unnecessary personal information, and identify immediate safeguarding concerns.

Preservation

Preserve and verify

Relevant URLs, account handles, messages, transaction references, screenshots, and public records are organised under stable evidence identifiers. We check authenticity and look for independent corroboration.

Assessment

Assess identity and jurisdiction

We evaluate infrastructure, language, time zones, payment routes, public records, and other lawful indicators to assess where an operator may be located. Location is always recorded with a confidence level.

Analysis

Compile the case report

Findings, linked entities, evidence grades, limitations, and the current conclusion are assembled into a reviewable case file. Allegations are distinguished from corroborated findings.

Referral

Refer to the appropriate authority

Where evidence and public-interest considerations support referral, we select an intake route based on the assessed jurisdiction and type of harm. The site records whether delivery is pending or confirmed.

Example reporting routes

Jurisdiction can be complex and authorities may redirect a report. These examples are starting points, not legal advice or a complete directory. Immediate danger should always be reported through the local emergency number.

Jurisdiction	Typical national intake	Other relevant routes	Common use
United Kingdom	Action Fraud / NFIB	Relevant territorial force, such as the Metropolitan Police, Police Scotland or PSNI	Fraud and cybercrime; local police for immediate risk or offences outside the national intake remit
United States	FBI Internet Crime Complaint Center (IC3)	Local police department or relevant FBI field office	Internet-enabled crime, fraud, extortion, account compromise and cross-state activity
Canada	Canadian Anti-Fraud Centre	Local police, RCMP, and the Canadian Centre for Cyber Security where appropriate	Fraud and cybercrime reports; local police remain positioned to investigate incidents
Dubai / UAE	Dubai Police eCrime	Dubai Police or the relevant local police service within the UAE	Cyber-enabled financial crime, scams and other cybercrime within the relevant emirate

Ghost Six records the authority actually contacted in each case. An intended route is never presented as a completed submission, and sensitive police references may be shortened or withheld from the public record.

Confidential reporting

Submit a tip anonymously

Describe the threat clearly and include useful evidence where it is safe and lawful to do so. You do not need to provide your real name.

Email ghostsix@tuta.io

Before you send: We recommend using a reputable VPN on a trusted device and network. A VPN can reduce some exposure, but it does not guarantee anonymity or protect you from unsafe files, account tracking, or identifying details inside documents.

Use separate contact details

Consider a new privacy-focused email address that does not contain your name or connect to your usual accounts.

Remove hidden metadata

Photos and documents can contain names, device details, revision history, and location data. Review or remove these before sending.

Do not take unnecessary risks

Do not confront a subject, trespass, hack an account, purchase illegal material, or continue contact solely to obtain evidence.

Use the right emergency route

If there is an immediate threat to life or ongoing abuse, contact local emergency services or the appropriate safeguarding authority first.

Send useful specifics

Dates, URLs, usernames, wallet addresses, transaction references, and a factual timeline are more useful than speculation.

Keep your own copy

Retain the original evidence securely. Avoid editing source files; send copies with unnecessary personal information removed.