Scam Campaign Report: Multi-Vector Financial Fraud and Malware Infrastructure Cluster This report documents a cluster of 4,628 connected entities identified through cross-referencing complaint databases, threat intelligence feeds, and community reporting. The cluster spans 1,295 phone numbers, 2,559 domains and IP addresses, 160 companies, and 252 email addresses. While the individual phone numbers in this cluster each carry zero FTC complaints at this time, the broader infrastructure surroundi...
trykojiva.com
First seen Mar 23, 2026
- No SSL certificate
- WHOIS registration hidden
- 1 community report from users
Campaign Intelligence
Scam Campaign Intelligence Report: Multi-Vector Financial and Malware Threat Cluster This report covers a cluster of 4,263 connected entities identified through aggregated complaint data, infrastructure analysis, and community reporting. The cluster encompasses 1,055 phone numbers, 2,451 domains and IP addresses, 146 companies, and 252 email addresses, forming one of the more complex mixed-threat groupings analyzed for consumer protection purposes. The campaign appears to exploit consumer famil...
Scam Campaign Report: Multi-Vector Financial Fraud and Infrastructure Cluster This report covers a cluster of 3,157 connected entities identified through shared reporting, co-appearance in consumer complaints, and cross-domain infrastructure linkages. The campaign spans 1,314 phone numbers, 1,486 domains, 170 companies, and 187 email addresses, with 16 documented cross-entity relationships. The cluster appears to blend legitimate financial institution impersonation with fraudulent domains, susp...
Our cybersecurity team has identified a multi-domain scam operation targeting job seekers through fraudulent employment offers. This campaign utilizes four interconnected domains: cobraintroducerinc.com, www.trykojiva.com, admiraltalents.com, and 1tapcashflow.com. All four domains were registered through NAMECHEAP INC within an eight-day period in February 2026, with registration dates spanning from February 12th to February 20th. The tight registration timeline and shared registrar indicate coo...
This cluster centers on 3 connected domains identified through shared infrastructure and registration patterns. The domains include www.trykojiva.com, lumensale.com, admiraltalents.com. Do not click links to any of the flagged domains. If you have visited one, check your accounts for unauthorized activity and consider changing your passwords. You can report suspicious contacts to the FTC at reportfraud.ftc.gov or to the FCC at consumercomplaints.fcc.gov. This campaign was identified through au...
This cybersecurity analysis reveals a sophisticated scam campaign operating through a network of 5 fraudulent domains that share common infrastructure and registration patterns. The domains lumensale.com, www.gregordiagnosticsinc.com, pinkmeldigestive.com, www.trykojiva.com, and admiraltalents.com are all registered through NAMECHEAP INC with suspicious future registration dates between February 8-13, 2026. All 5 domains share the same underlying infrastructure with moderate confidence levels of...
Details
Related Domains
gregordiagnosticsinc.com
same infrastructuredomainlumensale.com
same infrastructuredomainpinkmeldigestive.com
same infrastructuredomainadmiraltalents.com
same infrastructurephone8773824357
campaign co-memberphone8772427372
campaign co-memberphone3054749429
campaign co-memberphone9056283715
campaign co-memberphone2062221648
campaign co-memberphone8777058586
campaign co-memberphone5086371451
campaign co-memberphone2019841313
campaign co-memberphone4063591564
campaign co-memberphone2012011305
campaign co-memberphone3074282900
campaign co-memberphone3074011011
campaign co-memberphone3103658295
campaign co-memberphone8002305725
campaign co-memberphone3096844401
campaign co-memberphone8887729116
campaign co-memberphone9092565500
campaign co-memberphone9092565556
campaign co-memberphone8886016865
campaign co-memberphone9094561833
campaign co-memberCommunity Reports
Timeline of Events March 1, 2026 — Original Purchase * Purchased a face lymphatic brush from www.trykojiva.com for $34.95, advertised as “Buy 2, Get 1 Free.” * Payment made with Apple Card. * Received a confirmation email with Order #60694, but the email contained no order summary, no subtotal, no contact information, and no tracking details. March 8, 2026 — First Unauthorized Charge Attempt * Received an email from Apple stating a $49.99 charge from Looksmaxing (the merchant name used by TryKojiva) was declined. * Apple asked me to confirm whether this was my transaction. * Emailed [email protected] asking why they attempted to charge $49.99 when I only made one purchase for $34.95. March 9, 2026 — False Subscription Claim & Second Charge Attempt * Company replied claiming I had “opted into a subscription” for $49.99/month, which is false. No subscription was shown during checkout. * I emailed back requesting immediate cancellation of any subscription they claim I enrolled in. * That evening, the company attempted another $49.99 charge. * Contacted Apple Fraud and Security; they confirmed the charges were unauthorized and blocked the merchant. March 10, 2026 — Third Charge Attempt & Missing Order * Company attempted another $49.99 charge. * Contacted Apple again to report the repeated attempts. * Emailed the company separately requesting tracking information for my original order. * Company replied claiming the package “was shipped on March 7, 2026” and offered to send tracking information, but did not provide any tracking number. * Revisited the TryKojiva website and added the same item to my cart to review the checkout process. There is no subscription information anywhere on the site. March 11, 2026 — Fourth Charge Attempt * Company attempted yet another $49 [BBB Scam Type: Online Purchase] [Business: Kojiva] [Location: MA, USA- 02062]
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.