Ethics & policy — how we fight
Everything below attacks one of the three arteries of a scam operation — victim acquisition, conversion time, or payment collection — using AI, at personal scale, staying legal. The key principle throughout: we only touch infrastructure we own, data they sent us, or public reporting channels.
✅ What we do
- Extract indicators from emails you received
- File evidence with official channels: abuse desks, Google Safe Browsing, URLhaus, PhishTank, Chainabuse, FTC and international equivalents
- Draft registrar takedown letters citing the ICANN RAA
- Plant canary traps in your own property
- Run inbound-only decoy personas that waste scammer hours
- Educate potential victims before they convert
🚫 What we never do
- Deploy anything onto a scammer's machine — instant CFAA problem
- Scrape, flood or DDoS their systems — that is the same crime they commit
- Doxx — misidentification is constant and defamation exposure is real
- Initiate contact as a persona — inbound only, always
- Threaten, extort or "vigilante-expose" anyone
⚖️ Why it holds up
- Submitting evidence of crimes to standard reporting channels is lawful everywhere we operate
- A fake persona replying to a solicitation is not wire fraud — the deception is theirs
- Canary traps spring only on someone who took your property
- Every generated letter is factual, evidence-based, threatening-on-paper but never threatening-in-fact
Member conduct rules
Members agree to: submit only evidence they lawfully hold; review every outbound message themselves; never upload third parties' private data; never use personas to extract anything of value from a scammer beyond wasted time; never use the platform against a person who has not first solicited or deceived them. Violations → suspension. Serious violations → account deletion and, where warranted, reports to authorities. See Acceptable use.