When we launched Operation Takedown at Strategic Crypto Reserve at the end of October, the idea was simple: stop just deleting scam emails and start fighting back. Every phishing page, fake invoice and garbage “claim your bonus” site lives on somebody’s server and runs on somebody’s domain. Those companies have rules, and when you tell them clearly what is going on, they pull the plug.

Ten days in, I can say it plainly: Operation Takedown is well on its way, and we are going full speed ahead.

From a good idea to a machine that runs on its own

The first version was hands-on. A case came in, we pulled the headers apart, looked up who hosted what, and wrote the letters. On October 31 we ran a fake QuickBooks invoice phish through that process and reported it to 9 organisations in 6 minutes. That case became the sample report anyone can open, with the client’s details blacked out.

Six minutes is fast for a person. It is not fast enough for the volume of junk out there. So on November 4 we automated it. Now, when a customer forwards a scam email, the system reads the full headers, follows every hop back to where the message started, checks every link and domain, finds the right abuse desk for each one and sends the reports. Then it writes the customer a case report in the same format every time: verdict, red flags, the path the email took, who was notified and whether each report was delivered.

A real case from this week

Here is one from November 9 that shows what we are up against. It looked like a normal “verify your email” message from a legitimate event-invitation platform. But someone had signed up with a stranger’s address and typed a casino ad into the name field: an “instant $3000 bonus with zero deposit”. So the platform’s own trusted mail servers delivered the spam for them.

The link led to a redirect script planted on the website of a small accounting firm in Brazil. The firm had nothing to do with it; their site had been hacked. In under three minutes the case filed reports with:

• the platform that was abused, so it can close the fake account and clean up its sign-up form,
• the mail provider that carried the message,
• the hosting company running the hacked site, so it can remove the script and warn the owner,
• the Anti-Phishing Working Group, Canada’s Spam Reporting Centre and SpamCop, so the campaign lands on the blocklists.

One letter bounced on the first try because the site’s domain doesn’t take mail. We didn’t shrug and move on. We traced the server to its real owner and re-sent it to the right abuse desk. We also caught and fixed a small bug that was silently dropping one report. That is the point of doing this every day: each case makes the next one sharper.

Why this matters

Scammers count on two things: that you are too busy to report them, and that nobody will connect the dots. Most people delete the email and move on, and the site stays up to catch the next person. A single clear report to the right host can end a phishing page that would otherwise run for weeks.

Not sure whether a site is a scam? There is a free checker that tells you whether a site looks legit before you type a password into it. If you want to know exactly what happens after you forward something, here is every step from the moment your email arrives to the moment a host pulls the page.

Full speed ahead

We are not slowing down. More cases mean more scam sites gone, more hacked sites cleaned up and fewer people losing their savings or their logins to garbage criminal websites. If one lands in your inbox, don’t just delete it. Forward it to us and we will file every report for you: C$49 for one case, or C$29 a month for up to five.

And yes, it is the same team behind the configurator that prices an AI data hall from power budget to GPU racks. Building things and tearing down scams turn out to need the same skills: knowing exactly how the internet’s plumbing fits together.

FAQ

What is Operation Takedown?

Operation Takedown is the phishing and scam-website takedown service run by Strategic Crypto Reserve. You forward the scam email as an .eml file, and the team traces where it came from and files abuse reports with the hosting company, the domain registrar, the sending mail provider and anti-spam bodies.

How much does a takedown cost?

C$49 for a single case, or C$29 a month for up to 5 cases, in Canadian dollars plus applicable taxes.

How fast are the reports filed?

Usually within minutes. A fake-invoice phishing case on October 31, 2026 was traced and reported to 9 organisations in 6 minutes, and a November 9 case filed its reports in under 3 minutes. How fast a site actually goes offline depends on the host or registrar, often within hours to a couple of days.

Do I have to deal with the scammers?

No. Reports go to the companies that host, register or carry the scam, never to the scammer, and every case comes with a PDF report of what was found and who was notified.

Image license: featured graphic created by and © 2026 Kevin Katovic. Case details are summarised with customer and site-owner information left out.