Threat Hunter analyzed 651 brand water-army attack activities identified between 1 and 30 October 2026. The attacks involved multiple industries, including maternity and infant, beauty and personal care, and digital products. This report examines the distribution of targeted brands and industries, typical attack narratives, and the way comments are expressed—showing how water-army activity can influence consumers’ brand perceptions and purchase choices, and offering a reference for companies seeking to identify and respond to organized malicious attacks.
Reviewed English editionBrand water-armyBeauty and personal care
Read the English publication ↗A method brief on verifying subscription resale, understanding seller replacement economics and a measured account-level response.
Reviewed English editionsubscription resaleaccount governance
Read the English publication ↗Threat Hunter reviewed private-game-server activity on Telegram channels through October 29, 2026. Behind 1,003 entry points and 106 games sit just 48 server operators, one of which runs as many as 43 games. New supply comes mainly from existing operators rotating games and entry points, not from new groups entering. The things worth tracking are the ones that survive a game swap: operator nodes, agent back-ends, and support accounts.
Reviewed English editionprivate game serversgame security
Read the English publication ↗Drawing on 49 million active risky IPv4 addresses observed between September 27 and October 25, 2026 (77% on residential broadband), Threat Hunter quantifies four operational blind spots in static IP defense: newly observed risky IPs have a ~5-day half-life (32% last 1 day, 42.3% remain on Day 7), requiring a 7–14 day residential ban TTL; 7-day rolling blocklist coverage drops from 84.2% same-day to 79.5% after a 1-day lag and 67.1% after a 7-day lag, while 15.8% of daily risky IPs are first-time appearances; the 14% persistent IPs active ≥15 days drive 63% of risky activity; and 89% of risky IPs in China are hijacked shared home routers requiring step-up verification, while weekly active risky IPs outside China rose 29% in late October to 20.66 million.
Reviewed English editionIP risk intelligenceresidential proxies
Read the English publication ↗One script, five infant-formula brands named at once. Product-line nicknames instead of brand names, questions instead of claims, and RMB 0.25–0.4 (US$0.04–0.06) per ordinary negative comment. Threat Hunter tracked 613 paid attack tasks in September 2026. What they show is a piece-rate business built to look like genuine customer experience.
Reviewed English editionCybercrime researchBrand fraud
Read the English publication ↗As of 29 September 2026, Threat Hunter reviewed 169 public posts and coded 143 transaction amounts. The assessment focuses on attackers obtaining Apple Pay device PANs (DPANs) in bulk and submitting them into card-not-present channels where token scope and cardholder authentication were not enforced.
Reviewed English editionMastercardunauthorized transactions
Read the English publication ↗A single comment can look like ordinary customer feedback. In a task pipeline, it can also be a deliverable: a target post, a required action, proof of completion, then settlement. Threat Hunter monitored 20,000+ related items over roughly one month and identified 1,500+ tasks. Of those, 1,196 were comment tasks; 815 were negative comment tasks — 68.1% of all comment tasks.
Reviewed English editioninauthentic engagementcomment tasks
Read the English publication ↗Data Leakage Trends and Dark Web Risk Migration
Lending Data Leakage, Supply Chain Exposure, and Continued Abuse
Commercialization of Illegal Financial Information Lookup ServicesIn H1 2026, Threat Hunter verified 23,645 data leakage incidents involving 3,426 organizations. The report examines the growing concentration of high-risk data on the dark web, lending-data leakage across third-party supply chains, and the commercialization of illegal personal information lookup services. It also traces how leaked data is repeatedly resold and used for fraud, fake debt collection, targeted marketing, and profile enrichment.
Reviewed English editionAccount TakeoverData Leakage
Read the English publication ↗Half are gone in 30 days. Three in ten return after 90. Threat Hunter monitored 48,222 SMS-receiving numbers in July 2026: 56% appear once or span 30 days or less, and 32.7% are seen again after 90 days. These numbers are shelf inventory, so judge them on last-seen.
Reviewed English editionCybercrime researchBusiness fraud
Read the English publication ↗Threat Hunter tested 8 automation devices against real human input and collected 75,000+ operation events across 9 dimensions. A robotic arm can already look human on a single signal. Combinations of contact area, trajectory, and pressure are harder to fake. Dataset and method are open-sourced.
Reviewed English editionautomationbot detection
Read the English publication ↗THREAT HUNTER / RESEARCH2026
A half-year assessment of increasingly realistic, coordinated credit fraud across professional debt assumption, mortgage, business, auto, and consumer lending.
Reviewed English editioncredit frauddebt-assumption schemes
Read the English publication ↗THREAT HUNTER / RESEARCH2026
A half-year view of the channels, assets, and tactics behind brand impersonation, phishing, counterfeit distribution, and related external risk.
Reviewed English editionbrand protectionphishing
Read the English publication ↗