Where Scams Come From and Who They Target: Platform Version 2.11.0 - October 2026

We are pleased to announce the release of version 2.11.0 of the GSE platform. This month brings country-level context to every signal, a new type of fraud data that follows the money, and a major upgrade to our League Tables.

Targeted and Originating Geographies

Scams are rarely local. The infrastructure behind a scam is often run from one set of countries while its victims could be in a different set completely, and seeing both sides of that picture is essential if we are to disrupt at scale.

In August we told you we were working on Geographical Indices and this month we are delighted to deliver the first major step. Every GSE signal will now show both its Originating countries, where the scam infrastructure is located, and its Target countries, where its victims are based. You will start to see these data points appear in the signal detail breakdown on the platform.

For those working with our APIs, we are also releasing a dedicated endpoint to access this data, documented in the new Enhanced Signals section:

• Signal Geographies - /feed/signal-geographies

This lays the foundation for the geographical indices, league tables and analysis to come over the following months.

Following the Money: Fraudulent Bank Accounts

Every scam ultimately needs somewhere to send the money. This month we are pleased to welcome a new feed from iban.hinweishelden.com containing bank accounts (IBANs) used by fraudsters to collect payments from their victims, mainly across the EU. Cases come from fake shops, fake invoices, CEO fraud and other schemes.

Until now, most GSE signals have focused on the infrastructure that delivers scams, such as domains, URLs and phone numbers. This feed adds the accounts at the other end, giving banks, payment providers and investigators a new way to step in before money changes hands. You can apply for access to this feed within the Community Feeds section.

We have also improved the previously released feed made available by the Federal Trade Commission( FTC). This now provides phone numbers formatted to the E.164 international standard, making them much easier to match against other data in the GSE and within your own systems. This is also modelled as an open feed, and should now be available to your account.

League Tables: Faster, Fresher and Easier to Read

Our League Tables show which parts of the internet's infrastructure are most abused by scammers, and how quickly that abuse is being dealt with. This month they have had a significant upgrade:

• Updated daily. Totals and metrics are now recalculated every day instead of every week, so the tables reflect what is happening now.
• NEW 7-Day Trend filter. See at a glance which TLDs, Registrars and ASNs are climbing or falling over the past week.
• NEW rate type selection. Rank the tables by Report Rate, Dismantle Rate or Weighted Report Rate, depending on the question you are asking.
• Rates you can read at a glance. Rates are now shown as "1 in X" (for example, 1 in 62,500 domains), with the percentage underneath. The Dismantle Rate is shown against unique reported domains.
• Faster loading. A new data pipeline means the TLD, Registrar and ASN tables now load faster.

We have also updated our methodology to reflect these changes, which you can find in the League Table Docs.

Platform Improvements

• NEW date range filtering on the GSE overview dashboard. You can now view the signals received per day and the total signals available across any time period you choose.
• Redesigned signal sharing page. It is now easier to see which feeds you are currently sharing with the GSE.

API Documentation Updates

We have reorganised our API documentation into four clear sections: Signal Reports, Enhanced Signals, Sending Signals and Legacy Feeds, so related endpoints are now grouped together. As part of this:

• NEW My Feedback Reports (/feed/my-feedback-reports) returns all the feedback on the feeds you supply to the GSE, so contributors can see how their data is being used.
• 30 Day Signals (/feed/30day) and Signals by Source (/feed/source) are being deprecated in the coming months. Before they are switched off, we will introduce new endpoints that provide the same level of filtering. We will provide specific dates for the deprecation of these endpoints once these have been confirmed

Full details are available in our documentation.

We are always keen to hear back from our users with any suggestions for improvement or if you need any further clarification on use of the GSE. Please feel free to contact us on [email protected].