Scam Campaign
Identified on 6/21/2026
domain
frillyflair.comThis cluster centers on 9 connected domains identified through shared infrastructure and registration patterns. The domains include frillyflair.com, reviewbenchmark.com, cp.ivorydirect.us, avona-store.com, bohemebell.com, petportexpress.com, esinvestment.org, packageportal.net, cp.floraprovision.us.
This campaign was identified through automated analysis of threat intelligence feeds and entity relationship mapping.
By the Time Elder Fraud Looks Like Fraud, the Money Is Often Gone
A stranger calls an older woman, greets her as Grandma, and says her grandson is hurt and in police custody. The scariest part is how ordinary the next few minutes feel.
Seven 833-408 Numbers Are Tied to Fake Mortgage Servicer Mail and Calls
Consumers are reporting mailers and calls from numbers including (833) 408-1597 and (833) 408-1587 that impersonate mortgage servicers. Here is what the reports show.
Fake Chase Openers and Warm Transfers Feed a Three-Number Debt Fraud Operation
Callers impersonating Card Member Services are using intimidation tactics and transfer tricks to pressure consumers. Here is what the reports show.
Ignore Calls About an Unserved Summons Directing Contact to Janet Wilson
Callers posing as county process servers claim you have an unserved court summons and push you to contact a 'Janet Wilson' at toll-free numbers tied to a debt collection impersonation scheme.
833-382-5531 Is One of Eight Numbers on Fake Mortgage Postcards Hitting Homeowners
Postcards with real mortgage details and urgent language are being used to impersonate lenders including SmartFi. Here is what the reports show and how to protect yourself.
NordProtect — Identity theft monitoring and recovery
NordProtect watches for your personal info on the dark web, monitors your credit, and covers up to $1M in identity theft insurance.