Trust verification is the answer to that question — and it's simpler than most people think.

What Is Trust Verification?

Trust verification is the process of confirming that a person is who they claim to be before you meet them, transact with them, or share personal information with them. It goes beyond a gut feeling or a quick profile check. Real trust verification establishes that a specific email address, phone number, or identity belongs to a real, accountable person.

Think of it as the online equivalent of asking someone for ID before letting them into your home.

A verified person has taken steps to prove their identity — confirming their email, verifying their phone number, or completing additional identity checks. When you search someone on a trust verification platform and find their verified profile, you know two things: they are a real person, and they have put their name behind their online presence.

Why Trust Verification Matters

The internet makes it easy to be anonymous. That anonymity is useful for privacy — but it also enables fraud, scams, and misrepresentation at a scale that wasn't possible before.

Consider some of the most common situations where trust verification matters:

Buying and selling online. Marketplaces like Facebook Marketplace, Craigslist, and OfferUp connect millions of buyers and sellers every day. Most are legitimate. But scammers use the same platforms, hiding behind fake profiles and throwaway phone numbers. A verified seller has confirmed their contact information — if something goes wrong, they're accountable.

Online dating. Catfishing — creating a fake identity to deceive someone romantically — is widespread. A trust verification check before a first meeting takes less than a minute and tells you whether the person you've been talking to has a verified identity attached to their contact information.

Finding roommates. Signing a lease with someone is a serious commitment. A trust verification search on a potential roommate's email or phone gives you a baseline of confidence before you hand over keys or add someone to a lease agreement.

Hiring freelancers and gig workers. Whether you're hiring a handyman, a tutor, or a pet sitter, you're letting someone into your life or home. Verified profiles give service providers a way to demonstrate credibility — and give clients a way to check it.

Any situation involving a stranger. The common thread in all of these is simple: you're being asked to trust someone you don't know. Trust verification gives that trust a foundation beyond hope.

How Trust Verification Works

A trust verification platform like VerifyTrust works in two directions simultaneously: people can verify themselves, and anyone can search to check whether someone is verified.

Getting verified typically involves confirming your email address, verifying your phone number via SMS, and optionally completing additional steps like address verification or linking social media profiles. Each completed step increases your trust score and makes your profile more credible to anyone who searches you.

Searching someone is even simpler. Enter their email address or phone number. The platform checks whether that contact information is associated with a verified profile. Results appear instantly — no signup required to search.

The more verification steps a person has completed, the higher their trust score. A profile with verified email, phone, and location is significantly more credible than one with email alone — and a person with no profile at all is an unknown quantity worth approaching carefully.

What Trust Verification Is Not

Trust verification is not a background check. It does not search criminal records, credit history, or court filings. It confirms identity — that the person is real and accountable — rather than auditing their history.

It is also not a guarantee. A verified person could still behave badly. What verification does is raise the cost of deception: scammers and fraudsters rely on anonymity, and a platform that requires real contact information makes it significantly harder to operate under a false identity.

Think of trust verification as the first layer of due diligence — necessary but not sufficient on its own. Use it alongside your own judgment, public reviews, and common-sense precautions.

How to Use VerifyTrust

VerifyTrust is a free trust verification platform built for everyday online interactions. Here's how to use it:

To search someone: Enter their email address or phone number in the search bar on the homepage. Results are instant and free — no account required.

To get verified yourself: Create a free account and complete your verification steps. Start with email and phone verification (both free), and add location verification for a higher trust score. Share your VerifyTrust profile link with anyone you're connecting with online so they can see your verified status before you meet.

To build your reputation: Collect reviews from people you've transacted or connected with. Over time, your VerifyTrust profile becomes a portable trust record you can share in any marketplace, dating app, or professional context.

The Bottom Line

Trust verification is not about suspicion. It is about being a responsible participant in the online world — both protecting yourself and being someone others can confidently trust.

Searching someone before you meet costs nothing and takes seconds. Getting verified yourself takes minutes and pays dividends in every online interaction that follows.

The question is no longer whether you can trust someone. The question is whether you've taken the simple steps to find out.

Search Someone Now — It's Free

Get Verified in Minutes

First identified in August 2024, Aisuru has spread to at least 700,000 IoT systems, such as poorly secured Internet routers and security cameras. Aisuru’s overlords have used their massive botnet to clobber targets with headline-grabbing DDoS attacks, flooding targeted hosts with blasts of junk requests from all infected systems simultaneously.

In June, Aisuru hit KrebsOnSecurity.com with a DDoS clocking at 6.3 terabits per second — the biggest attack that Google had ever mitigated at the time. In the weeks and months that followed, Aisuru’s operators demonstrated DDoS capabilities of nearly 30 terabits of data per second — well beyond the attack mitigation capabilities of most Internet destinations.

These digital sieges have been particularly disruptive this year for U.S.-based Internet service providers (ISPs), in part because Aisuru recently succeeded in taking over a large number of IoT devices in the United States. And when Aisuru launches attacks, the volume of outgoing traffic from infected systems on these ISPs is often so high that it can disrupt or degrade Internet service for adjacent (non-botted) customers of the ISPs.

“Multiple broadband access network operators have experienced significant operational impact due to outbound DDoS attacks in excess of 1.5Tb/sec launched from Aisuru botnet nodes residing on end-customer premises,” wrote Roland Dobbins, principal engineer at Netscout, in a recent executive summary on Aisuru. “Outbound/crossbound attack traffic exceeding 1Tb/sec from compromised customer premise equipment (CPE) devices has caused significant disruption to wireline and wireless broadband access networks. High-throughput attacks have caused chassis-based router line card failures.”

The incessant attacks from Aisuru have caught the attention of federal authorities in the United States and Europe (many of Aisuru’s victims are customers of ISPs and hosting providers based in Europe). Quite recently, some of the world’s largest ISPs have started informally sharing block lists identifying the rapidly shifting locations of the servers that the attackers use to control the activities of the botnet.

Experts say the Aisuru botmasters recently updated their malware so that compromised devices can more easily be rented to so-called “residential proxy” providers. These proxy services allow paying customers to route their Internet communications through someone else’s device, providing anonymity and the ability to appear as a regular Internet user in almost any major city worldwide.

From a website’s perspective, the IP traffic of a residential proxy network user appears to originate from the rented residential IP address, not from the proxy service customer. Proxy services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence. But they are massively abused for hiding cybercrime activity (think advertising fraud, credential stuffing) because they can make it difficult to trace malicious traffic to its original source.

And as we’ll see in a moment, this entire shadowy industry appears to be shifting its focus toward enabling aggressive content scraping activity that continuously feeds raw data into large language models (LLMs) built to support various AI projects.

‘INSANE’ GROWTH

Riley Kilmer is co-founder of spur.us, a service that tracks proxy networks. Kilmer said all of the top proxy services have grown substantially over the past six months.

“I just checked, and in the last 90 days we’ve seen 250 million unique residential proxy IPs,” Kilmer said. “That is insane. That is so high of a number, it’s unheard of. These proxies are absolutely everywhere now.”

Today, Spur says it is tracking an unprecedented spike in available proxies across all providers, including;

LUMINATI_PROXY    11,856,421
NETNUT_PROXY    10,982,458
ABCPROXY_PROXY    9,294,419
OXYLABS_PROXY     6,754,790
IPIDEA_PROXY     3,209,313
EARNFM_PROXY    2,659,913
NODEMAVEN_PROXY    2,627,851
INFATICA_PROXY    2,335,194
IPROYAL_PROXY    2,032,027
YILU_PROXY    1,549,155

Reached for comment about the apparent rapid growth in their proxy network, Oxylabs (#4 on Spur’s list) said while their proxy pool did grow recently, it did so at nowhere near the rate cited by Spur.

“We don’t systematically track other providers’ figures, and we’re not aware of any instances of 10× or 100× growth, especially when it comes to a few bigger companies that are legitimate businesses,” the company said in a written statement.

Bright Data was formerly known as Luminati Networks, the name that is currently at the top of Spur’s list of the biggest residential proxy networks. Bright Data likewise told KrebsOnSecurity that Spur’s current estimates of its proxy network are dramatically overstated and inaccurate.

“We did not actively initiate nor do we see any 10x or 100x expansion of our network, which leads me to believe that someone might be presenting these IPs as Bright Data’s in some way,” said Rony Shalit, Bright Data’s chief compliance and ethics officer. “In many cases in the past, due to us being the leading data collection proxy provider, IPs were falsely tagged as being part of our network, or while being used by other proxy providers for malicious activity.”

“Our network is only sourced from verified IP providers and a robust opt-in only residential peers, which we work hard and in complete transparency to obtain,” Shalit continued. “Every DC, ISP or SDK partner is reviewed and approved, and every residential peer must actively opt in to be part of our network.”

HK NETWORK

Even Spur acknowledges that Luminati and Oxylabs are unlike most other proxy services on their top proxy providers list, in that these providers actually adhere to “know-your-customer” policies, such as requiring video calls with all customers, and strictly blocking customers from reselling access.

Benjamin Brundage is founder of Synthient, a startup that helps companies detect proxy networks. Brundage said if there is increasing confusion around which proxy networks are the most worrisome, it’s because nearly all of these lesser-known proxy services have evolved into highly incestuous bandwidth resellers. What’s more, he said, some proxy providers do not appreciate being tracked and have been known to take aggressive steps to confuse systems that scan the Internet for residential proxy nodes.

Brundage said most proxy services today have created their own software development kit or SDK that other app developers can bundle with their code to earn revenue. These SDKs quietly modify the user’s device so that some portion of their bandwidth can be used to forward traffic from proxy service customers.

“Proxy providers have pools of constantly churning IP addresses,” he said. “These IP addresses are sourced through various means, such as bandwidth-sharing apps, botnets, Android SDKs, and more. These providers will often either directly approach resellers or offer a reseller program that allows users to resell bandwidth through their platform.”

Many SDK providers say they require full consent before allowing their software to be installed on end-user devices. Still, those opt-in agreements and consent checkboxes may be little more than a formality for cybercriminals like the Aisuru botmasters, who can earn a commission each time one of their infected devices is forced to install some SDK that enables one or more of these proxy services.

Depending on its structure, a single provider may operate hundreds of different proxy pools at a time — all maintained through other means, Brundage said.

“Often, you’ll see resellers maintaining their own proxy pool in addition to an upstream provider,” he said. “It allows them to market a proxy pool to high-value clients and offer an unlimited bandwidth plan for cheap reduce their own costs.”

Some proxy providers appear to be directly in league with botmasters. Brundage identified one proxy seller that was aggressively advertising cheap and plentiful bandwidth to content scraping companies. After scanning that provider’s pool of available proxies, Brundage said he found a one-to-one match with IP addresses he’d previously mapped to the Aisuru botnet.

Brundage says that by almost any measurement, the world’s largest residential proxy service is IPidea, a China-based proxy network. IPidea is #5 on Spur’s Top 10, and Brundage said its brands include ABCProxy (#3), Roxlabs, LunaProxy, PIA S5 Proxy, PyProxy, 922Proxy, 360Proxy, IP2World, and Cherry Proxy. Spur’s Kilmer said they also track Yilu Proxy (#10) as IPidea.

Brundage said all of these providers operate under a corporate umbrella known on the cybercrime forums as “HK Network.”

“The way it works is there’s this whole reseller ecosystem, where IPidea will be incredibly aggressive and approach all these proxy providers with the offer, ‘Hey, if you guys buy bandwidth from us, we’ll give you these amazing reseller prices,'” Brundage explained. “But they’re also very aggressive in recruiting resellers for their apps.”

A graphic depicting the relationship between proxy providers that Synthient found are white labeling IPidea proxies. Image: Synthient.com.

Those apps include a range of low-cost and “free” virtual private networking (VPN) services that indeed allow users to enjoy a free VPN, but which also turn the user’s device into a traffic relay that can be rented to cybercriminals, or else parceled out to countless other proxy networks.

“They have all this bandwidth to offload,” Brundage said of IPidea and its sister networks. “And they can do it through their own platforms, or they go get resellers to do it for them by advertising on sketchy hacker forums to reach more people.”

One of IPidea’s core brands is 922S5Proxy, which is a not-so-subtle nod to the 911S5Proxy service that was hugely popular between 2015 and 2022. In July 2022, KrebsOnSecurity published a deep dive into 911S5Proxy’s origins and apparent owners in China. Less than a week later, 911S5Proxy announced it was closing down after the company’s servers were massively hacked.

That 2022 story named Yunhe Wang from Beijing as the apparent owner and/or manager of the 911S5 proxy service. In May 2024, the U.S. Department of Justice arrested Mr Wang, alleging that his network was used to steal billions of dollars from financial institutions, credit card issuers, and federal lending programs. At the same time, the U.S. Treasury Department announced sanctions against Wang and two other Chinese nationals for operating 911S5Proxy.

The website for 922Proxy.

DATA SCRAPING FOR AI

In recent months, multiple experts who track botnet and proxy activity have shared that a great deal of content scraping which ultimately benefits AI companies is now leveraging these proxy networks to further obfuscate their aggressive data-slurping activity. That’s because by routing it through residential IP addresses, content scraping firms can make their traffic far trickier to filter out.

“It’s really difficult to block, because there’s a risk of blocking real people,” Spur’s Kilmer said of the LLM scraping activity that is fed through individual residential IP addresses, which are often shared by multiple customers at once.

Kilmer says the AI industry has brought a veneer of legitimacy to residential proxy business, which has heretofore mostly been associated with sketchy affiliate money making programs, automated abuse, and unwanted Internet traffic.

“Web crawling and scraping has always been a thing, but AI made it like a commodity, data that had to be collected,” Kilmer said. “Everybody wanted to monetize their own data pots, and how they monetize that is different across the board.”

Kilmer said many LLM-related scrapers rely on residential proxies in cases where the content provider has restricted access to their platform in some way, such as forcing interaction through an app, or keeping all content behind a login page with multi-factor authentication.

“Where the cost of data is out of reach — there is some exclusivity or reason they can’t access the data — they’ll turn to residential proxies so they look like a real person accessing that data,” Kilmer said of the content scraping efforts.

Aggressive AI crawlers increasingly are overloading community-maintained infrastructure, causing what amounts to persistent DDoS attacks on vital public resources. A report earlier this year from LibreNews found some open-source projects now see as much as 97 percent of their traffic originating from AI company bots, dramatically increasing bandwidth costs, service instability, and burdening already stretched-thin maintainers.

Cloudflare is now experimenting with tools that will allow content creators to charge a fee to AI crawlers to scrape their websites. The company’s “pay-per-crawl” feature is currently in a private beta, and it lets publishers set their own prices that bots must pay before scraping content.

On October 22, the social media and news network Reddit sued Oxylabs (PDF) and several other proxy providers, alleging that their systems enabled the mass-scraping of Reddit user content even though Reddit had taken steps to block such activity.

“Recognizing that Reddit denies scrapers like them access to its site, Defendants scrape the data from Google’s search results instead,” the lawsuit alleges. “They do so by masking their identities, hiding their locations, and disguising their web scrapers as regular people (among other techniques) to circumvent or bypass the security restrictions meant to stop them.”

Denas Grybauskas, chief governance and strategy officer at Oxylabs, said the company was shocked and disappointed by the lawsuit.

“Reddit has made no attempt to speak with us directly or communicate any potential concerns,” Grybauskas said in a written statement. “Oxylabs has always been and will continue to be a pioneer and an industry leader in public data collection, and it will not hesitate to defend itself against these allegations. Oxylabs’ position is that no company should claim ownership of public data that does not belong to them. It is possible that it is just an attempt to sell the same public data at an inflated price.”

As big and powerful as Aisuru may be, it is hardly the only botnet that is contributing to the overall broad availability of residential proxies. For example, on June 5 the FBI’s Internet Crime Complaint Center warned that an IoT malware threat dubbed BADBOX 2.0 had compromised millions of smart-TV boxes, digital projectors, vehicle infotainment units, picture frames, and other IoT devices.

In July, Google filed a lawsuit in New York federal court against the Badbox botnet’s alleged perpetrators. Google said the Badbox 2.0 botnet “compromised more than 10 million uncertified devices running Android’s open-source software, which lacks Google’s security protections. Cybercriminals infected these devices with pre-installed malware and exploited them to conduct large-scale ad fraud and other digital crimes.”

A FAMILIAR DOMAIN NAME

Brundage said the Aisuru botmasters have their own SDK, and for some reason part of its code tells many newly-infected systems to query the domain name fuckbriankrebs[.]com. This may be little more than an elaborate “screw you” to this site’s author: One of the botnet’s alleged partners goes by the handle “Forky,” and was identified in June by KrebsOnSecurity as a young man from Sao Paulo, Brazil.

Brundage noted that only systems infected with Aisuru’s Android SDK will be forced to resolve the domain. Initially, there was some discussion about whether the domain might have some utility as a “kill switch” capable of disrupting the botnet’s operations, although Brundage and others interviewed for this story say that is unlikely.

A tiny sample of the traffic after a DNS server was enabled on the newly registered domain fuckbriankrebs dot com. Each unique IP address requested its own unique subdomain. Image: Seralys.

For one thing, they said, if the domain was somehow critical to the operation of the botnet, why was it still unregistered and actively for-sale? Why indeed, we asked. Happily, the domain name was deftly snatched up last week by Philippe Caturegli, “chief hacking officer” for the security intelligence company Seralys.

Caturegli enabled a passive DNS server on that domain and within a few hours received more than 700,000 requests for unique subdomains on fuckbriankrebs[.]com.

But even with that visibility into Aisuru, it is difficult to use this domain check-in feature to measure its true size, Brundage said. After all, he said, the systems that are phoning home to the domain are only a small portion of the overall botnet.

“The bots are hardcoded to just spam lookups on the subdomains,” he said. “So anytime an infection occurs or it runs in the background, it will do one of those DNS queries.”

Caturegli briefly configured all subdomains on fuckbriankrebs dot com to display this ASCII art image to visiting systems today.

The domain fuckbriankrebs[.]com has a storied history. On its initial launch in 2009, it was used to spread malicious software by the Cutwail spam botnet. In 2011, the domain was involved in a notable DDoS against this website from a botnet powered by Russkill (a.k.a. “Dirt Jumper”).

Domaintools.com finds that in 2015, fuckbriankrebs[.]com was registered to an email address attributed to David “Abdilo” Crees, a 27-year-old Australian man sentenced in May 2025 to time served for cybercrime convictions related to the Lizard Squad hacking group.

Update, Nov. 1, 2025, 10:25 a.m. ET: An earlier version of this story erroneously cited Spur’s proxy numbers from earlier this year; Spur said those numbers conflated residential proxies — which are rotating and attached to real end-user devices — with “ISP proxies” located at AT&T. ISP proxies, Spur said, involve tricking an ISP into routing a large number of IP addresses that are resold as far more static datacenter proxies.

Sources close to the investigation say Yuriy Igorevich Rybtsov, a 41-year-old from the Russia-controlled city of Donetsk, Ukraine, was previously referenced in U.S. federal charging documents only by his online handle “MrICQ.” According to a 13-year-old indictment (PDF) filed by prosecutors in Nebraska, MrICQ was a developer for a cybercrime group known as “Jabber Zeus.”

Image: lockedup dot wtf.

The Jabber Zeus name is derived from the malware they used — a custom version of the ZeuS banking trojan — that stole banking login credentials and would send the group a Jabber instant message each time a new victim entered a one-time passcode at a financial institution website. The gang targeted mostly small to mid-sized businesses, and they were an early pioneer of so-called “man-in-the-browser” attacks, malware that can silently intercept any data that victims submit in a web-based form.

Once inside a victim company’s accounts, the Jabber Zeus crew would modify the firm’s payroll to add dozens of “money mules,” people recruited through elaborate work-at-home schemes to handle bank transfers. The mules in turn would forward any stolen payroll deposits — minus their commissions — via wire transfers to other mules in Ukraine and the United Kingdom.

The 2012 indictment targeting the Jabber Zeus crew named MrICQ as “John Doe #3,” and said this person handled incoming notifications of newly compromised victims. The Department of Justice (DOJ) said MrICQ also helped the group launder the proceeds of their heists through electronic currency exchange services.

Two sources familiar with the Jabber Zeus investigation said Rybtsov was arrested in Italy, although the exact date and circumstances of his arrest remain unclear. A summary of recent decisions (PDF) published by the Italian Supreme Court states that in April 2025, Rybtsov lost a final appeal to avoid extradition to the United States.

According to the mugshot website lockedup[.]wtf, Rybtsov arrived in Nebraska on October 9, and was being held under an arrest warrant from the U.S. Federal Bureau of Investigation (FBI).

The data breach tracking service Constella Intelligence found breached records from the business profiling site bvdinfo[.]com showing that a 41-year-old Yuriy Igorevich Rybtsov worked in a building at 59 Barnaulska St. in Donetsk. Further searching on this address in Constella finds the same apartment building was shared by a business registered to Vyacheslav “Tank” Penchukov, the leader of the Jabber Zeus crew in Ukraine.

Vyacheslav “Tank” Penchukov, seen here performing as “DJ Slava Rich” in Ukraine, in an undated photo from social media.

Penchukov was arrested in 2022 while traveling to meet his wife in Switzerland. Last year, a federal court in Nebraska sentenced Penchukov to 18 years in prison and ordered him to pay more than $73 million in restitution.

Lawrence Baldwin is founder of myNetWatchman, a threat intelligence company based in Georgia that began tracking and disrupting the Jabber Zeus gang in 2009. myNetWatchman had secretly gained access to the Jabber chat server used by the Ukrainian hackers, allowing Baldwin to eavesdrop on the daily conversations between MrICQ and other Jabber Zeus members.

Baldwin shared those real-time chat records with multiple state and federal law enforcement agencies, and with this reporter. Between 2010 and 2013, I spent several hours each day alerting small businesses across the country that their payroll accounts were about to be drained by these cybercriminals.

Those notifications, and Baldwin’s tireless efforts, saved countless would-be victims a great deal of money. In most cases, however, we were already too late. Nevertheless, the pilfered Jabber Zeus group chats provided the basis for dozens of stories published here about small businesses fighting their banks in court over six- and seven-figure financial losses.

Baldwin said the Jabber Zeus crew was far ahead of its peers in several respects. For starters, their intercepted chats showed they worked to create a highly customized botnet directly with the author of the original Zeus Trojan — Evgeniy Mikhailovich Bogachev, a Russian man who has long been on the FBI’s “Most Wanted” list. The feds have a standing $3 million reward for information leading to Bogachev’s arrest.

Evgeniy M. Bogachev, in undated photos.

The core innovation of Jabber Zeus was an alert that MrICQ would receive each time a new victim entered a one-time password code into a phishing page mimicking their financial institution. The gang’s internal name for this component was “Leprechaun,” (the video below from myNetWatchman shows it in action). Jabber Zeus would actually re-write the HTML code as displayed in the victim’s browser, allowing them to intercept any passcodes sent by the victim’s bank for multi-factor authentication.

“These guys had compromised such a large number of victims that they were getting buried in a tsunami of stolen banking credentials,” Baldwin told KrebsOnSecurity. “But the whole point of Leprechaun was to isolate the highest-value credentials — the commercial bank accounts with two-factor authentication turned on. They knew these were far juicier targets because they clearly had a lot more money to protect.”

Baldwin said the Jabber Zeus trojan also included a custom “backconnect” component that allowed the hackers to relay their bank account takeovers through the victim’s own infected PC.

“The Jabber Zeus crew were literally connecting to the victim’s bank account from the victim’s IP address, or from the remote control function and by fully emulating the device,” he said. “That trojan was like a hot knife through butter of what everyone thought was state-of-the-art secure online banking at the time.”

Although the Jabber Zeus crew was in direct contact with the Zeus author, the chats intercepted by myNetWatchman show Bogachev frequently ignored the group’s pleas for help. The government says the real leader of the Jabber Zeus crew was Maksim Yakubets, a 38-year Ukrainian man with Russian citizenship who went by the hacker handle “Aqua.”

Alleged Evil Corp leader Maksim “Aqua” Yakubets. Image: FBI

The Jabber chats intercepted by Baldwin show that Aqua interacted almost daily with MrICQ, Tank and other members of the hacking team, often facilitating the group’s money mule and cashout activities remotely from Russia.

The government says Yakubets/Aqua would later emerge as the leader of an elite cybercrime ring of at least 17 hackers that referred to themselves internally as “Evil Corp.” Members of Evil Corp developed and used the Dridex (a.k.a. Bugat) trojan, which helped them siphon more than $100 million from hundreds of victim companies in the United States and Europe.

This 2019 story about the government’s $5 million bounty for information leading to Yakubets’s arrest includes excerpts of conversations between Aqua, Tank, Bogachev and other Jabber Zeus crew members discussing stories I’d written about their victims. Both Baldwin and I were interviewed at length for a new weekly six-part podcast by the BBC that delves deep into the history of Evil Corp. Episode One focuses on the evolution of Zeus, while the second episode centers on an investigation into the group by former FBI agent Jim Craig.

Image: https://www.bbc.co.uk/programmes/w3ct89y8

The #1 and #3 positions in this chart are Aisuru botnet controllers with their full domain names redacted. Source: radar.cloudflare.com.

Aisuru is a rapidly growing botnet comprising hundreds of thousands of hacked Internet of Things (IoT) devices, such as poorly secured Internet routers and security cameras. The botnet has increased in size and firepower significantly since its debut in 2024, demonstrating the ability to launch record distributed denial-of-service (DDoS) attacks nearing 30 terabits of data per second.

Until recently, Aisuru’s malicious code instructed all infected systems to use DNS servers from Google — specifically, the servers at 8.8.8.8. But in early October, Aisuru switched to invoking Cloudflare’s main DNS server — 1.1.1.1 — and over the past week domains used by Aisuru to control infected systems started populating Cloudflare’s top domain rankings.

As screenshots of Aisuru domains claiming two of the Top 10 positions ping-ponged across social media, many feared this was yet another sign that an already untamable botnet was running completely amok. One Aisuru botnet domain that sat prominently for days at #1 on the list was someone’s street address in Massachusetts followed by “.com”. Other Aisuru domains mimicked those belonging to major cloud providers.

Cloudflare tried to address these security, brand confusion and privacy concerns by partially redacting the malicious domains, and adding a warning at the top of its rankings:

“Note that the top 100 domains and trending domains lists include domains with organic activity as well as domains with emerging malicious behavior.”

Cloudflare CEO Matthew Prince told KrebsOnSecurity the company’s domain ranking system is fairly simplistic, and that it merely measures the volume of DNS queries to 1.1.1.1.

“The attacker is just generating a ton of requests, maybe to influence the ranking but also to attack our DNS service,” Prince said, adding that Cloudflare has heard reports of other large public DNS services seeing similar uptick in attacks. “We’re fixing the ranking to make it smarter. And, in the meantime, redacting any sites we classify as malware.”

Renee Burton, vice president of threat intel at the DNS security firm Infoblox, said many people erroneously assumed that the skewed Cloudflare domain rankings meant there were more bot-infected devices than there were regular devices querying sites like Google and Apple and Microsoft.

“Cloudflare’s documentation is clear — they know that when it comes to ranking domains you have to make choices on how to normalize things,” Burton wrote on LinkedIn. “There are many aspects that are simply out of your control. Why is it hard? Because reasons. TTL values, caching, prefetching, architecture, load balancing. Things that have shared control between the domain owner and everything in between.”

Alex Greenland is CEO of the anti-phishing and security firm Epi. Greenland said he understands the technical reason why Aisuru botnet domains are showing up in Cloudflare’s rankings (those rankings are based on DNS query volume, not actual web visits). But he said they’re still not meant to be there.

“It’s a failure on Cloudflare’s part, and reveals a compromise of the trust and integrity of their rankings,” he said.

Greenland said Cloudflare planned for its Domain Rankings to list the most popular domains as used by human users, and it was never meant to be a raw calculation of query frequency or traffic volume going through their 1.1.1.1 DNS resolver.

“They spelled out how their popularity algorithm is designed to reflect real human use and exclude automated traffic (they said they’re good at this),” Greenland wrote on LinkedIn. “So something has evidently gone wrong internally. We should have two rankings: one representing trust and real human use, and another derived from raw DNS volume.”

Why might it be a good idea to wholly separate malicious domains from the list? Greenland notes that Cloudflare Domain Rankings see widespread use for trust and safety determination, by browsers, DNS resolvers, safe browsing APIs and things like TRANCO.

“TRANCO is a respected open source list of the top million domains, and Cloudflare Radar is one of their five data providers,” he continued. “So there can be serious knock-on effects when a malicious domain features in Cloudflare’s top 10/100/1000/million. To many people and systems, the top 10 and 100 are naively considered safe and trusted, even though algorithmically-defined top-N lists will always be somewhat crude.”

Over this past week, Cloudflare started redacting portions of the malicious Aisuru domains from its Top Domains list, leaving only their domain suffix visible. Sometime in the past 24 hours, Cloudflare appears to have begun hiding the malicious Aisuru domains entirely from the web version of that list. However, downloading a spreadsheet of the current Top 200 domains from Cloudflare Radar shows an Aisuru domain still at the very top.

According to Cloudflare’s website, the majority of DNS queries to the top Aisuru domains — nearly 52 percent — originated from the United States. This tracks with my reporting from early October, which found Aisuru was drawing most of its firepower from IoT devices hosted on U.S. Internet providers like AT&T, Comcast and Verizon.

Experts tracking Aisuru say the botnet relies on well more than a hundred control servers, and that for the moment at least most of those domains are registered in the .su top-level domain (TLD). Dot-su is the TLD assigned to the former Soviet Union (.su’s Wikipedia page says the TLD was created just 15 months before the fall of the Berlin wall).

A Cloudflare blog post from October 27 found that .su had the highest “DNS magnitude” of any TLD, referring to a metric estimating the popularity of a TLD based on the number of unique networks querying Cloudflare’s 1.1.1.1 resolver. The report concluded that the top .su hostnames were associated with a popular online world-building game, and that more than half of the queries for that TLD came from the United States, Brazil and Germany [it’s worth noting that servers for the world-building game Minecraft were some of Aisuru’s most frequent targets].

A simple and crude way to detect Aisuru bot activity on a network may be to set an alert on any systems attempting to contact domains ending in .su. This TLD is frequently abused for cybercrime and by cybercrime forums and services, and blocking access to it entirely is unlikely to raise any legitimate complaints.

A TP-Link WiFi 6 AX1800 Smart WiFi Router (Archer AX20).

The Washington Post recently reported that more than a half-dozen federal departments and agencies were backing a proposed ban on future sales of TP-Link devices in the United States. The story said U.S. Department of Commerce officials concluded TP-Link Systems products pose a risk because the U.S.-based company’s products handle sensitive American data and because the officials believe it remains subject to jurisdiction or influence by the Chinese government.

TP-Link Systems denies that, saying that it fully split from the Chinese TP-Link Technologies over the past three years, and that its critics have vastly overstated the company’s market share (TP-Link puts it at around 30 percent). TP-Link says it has headquarters in California, with a branch in Singapore, and that it manufactures in Vietnam. The company says it researches, designs, develops and manufactures everything except its chipsets in-house.

TP-Link Systems told The Post it has sole ownership of some engineering, design and manufacturing capabilities in China that were once part of China-based TP-Link Technologies, and that it operates them without Chinese government supervision.

“TP-Link vigorously disputes any allegation that its products present national security risks to the United States,” Ricca Silverio, a spokeswoman for TP-Link Systems, said in a statement. “TP-Link is a U.S. company committed to supplying high-quality and secure products to the U.S. market and beyond.”

Cost is a big reason TP-Link devices are so prevalent in the consumer and small business market: As this February 2025 story from Wired observed regarding the proposed ban, TP-Link has long had a reputation for flooding the market with devices that are considerably cheaper than comparable models from other vendors. That price point (and consistently excellent performance ratings) has made TP-Link a favorite among Internet service providers (ISPs) that provide routers to their customers.

In August 2024, the chairman and the ranking member of the House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party called for an investigation into TP-Link devices, which they said were found on U.S. military bases and for sale at exchanges that sell them to members of the military and their families.

“TP-Link’s unusual degree of vulnerabilities and required compliance with PRC law are in and of themselves disconcerting,” the House lawmakers warned in a letter (PDF) to the director of the Commerce Department. “When combined with the PRC government’s common use of SOHO [small office/home office] routers like TP-Link to perpetrate extensive cyberattacks in the United States, it becomes significantly alarming.”

The letter cited a May 2023 blog post by Check Point Research about a Chinese state-sponsored hacking group dubbed “Camaro Dragon” that used a malicious firmware implant for some TP-Link routers to carry out a sequence of targeted cyberattacks against European foreign affairs entities. Check Point said while it only found the malicious firmware on TP-Link devices, “the firmware-agnostic nature of the implanted components indicates that a wide range of devices and vendors may be at risk.”

In a report published in October 2024, Microsoft said it was tracking a network of compromised TP-Link small office and home office routers that has been abused by multiple distinct Chinese state-sponsored hacking groups since 2021. Microsoft found the hacker groups were leveraging the compromised TP-Link systems to conduct “password spraying” attacks against Microsoft accounts. Password spraying involves rapidly attempting to access a large number of accounts (usernames/email addresses) with a relatively small number of commonly used passwords.

TP-Link rightly points out that most of its competitors likewise source components from China. The company also correctly notes that advanced persistent threat (APT) groups from China and other nations have leveraged vulnerabilities in products from their competitors, such as Cisco and Netgear.

But that may be cold comfort for TP-Link customers who are now wondering if it’s smart to continue using these products, or whether it makes sense to buy more costly networking gear that might only be marginally less vulnerable to compromise.

Almost without exception, the hardware and software that ships with most consumer-grade routers includes a number of default settings that need to be changed before the devices can be safely connected to the Internet. For example, bring a new router online without changing the default username and password and chances are it will only take a few minutes before it is probed and possibly compromised by some type of Internet-of-Things botnet. Also, it is incredibly common for the firmware in a brand new router to be dangerously out of date by the time it is purchased and unboxed.

Until quite recently, the idea that router manufacturers should make it easier for their customers to use these products safely was something of an anathema to this industry. Consumers were largely left to figure that out on their own, with predictably disastrous results.

But over the past few years, many manufacturers of popular consumer routers have begun forcing users to perform basic hygiene — such as changing the default password and updating the internal firmware — before the devices can be used as a router. For example, most brands of “mesh” wireless routers — like Amazon’s Eero, Netgear’s Orbi series, or Asus’s ZenWifi — require online registration that automates these critical steps going forward (or at least through their stated support lifecycle).

For better or worse, less expensive, traditional consumer routers like those from Belkin and Linksys also now automate this setup by heavily steering customers toward installing a mobile app to complete the installation (this often comes as a shock to people more accustomed to manually configuring a router). Still, these products tend to put the onus on users to check for and install available updates periodically. Also, they’re often powered by underwhelming or else bloated firmware, and a dearth of configurable options.

Of course, not everyone wants to fiddle with mobile apps or is comfortable with registering their router so that it can be managed or monitored remotely in the cloud. For those hands-on folks — and for power users seeking more advanced router features like VPNs, ad blockers and network monitoring — the best advice is to check if your router’s stock firmware can be replaced with open-source alternatives, such as OpenWrt or DD-WRT.

These open-source firmware options are compatible with a wide range of devices, and they generally offer more features and configurability. Open-source firmware can even help extend the life of routers years after the vendor stops supporting the underlying hardware, but it still requires users to manually check for and install any available updates.

Happily, TP-Link users spooked by the proposed ban may have an alternative to outright junking these devices, as many TP-Link routers also support open-source firmware options like OpenWRT. While this approach may not eliminate any potential hardware-specific security flaws, it could serve as an effective hedge against more common vendor-specific vulnerabilities, such as undocumented user accounts, hard-coded credentials, and weaknesses that allow attackers to bypass authentication.

Regardless of the brand, if your router is more than four or five years old it may be worth upgrading for performance reasons alone — particularly if your home or office is primarily accessing the Internet through WiFi.

NB: The Post’s story notes that a substantial portion of TP-Link routers and those of its competitors are purchased or leased through ISPs. In these cases, the devices are typically managed and updated remotely by your ISP, and equipped with custom profiles responsible for authenticating your device to the ISP’s network. If this describes your setup, please do not attempt to modify or replace these devices without first consulting with your Internet provider.

In a lawsuit filed in the Southern District of New York on November 12, Google sued to unmask and disrupt 25 “John Doe” defendants allegedly linked to the sale of Lighthouse, a sophisticated phishing kit that makes it simple for even novices to steal payment card data from mobile users. Google said Lighthouse has harmed more than a million victims across 120 countries.

A component of the Chinese phishing kit Lighthouse made to target customers of The Toll Roads, which refers to several state routes through Orange County, Calif.

Lighthouse is one of several prolific phishing-as-a-service operations known as the “Smishing Triad,” and collectively they are responsible for sending millions of text messages that spoof the U.S. Postal Service to supposedly collect some outstanding delivery fee, or that pretend to be a local toll road operator warning of a delinquent toll fee. More recently, Lighthouse has been used to spoof e-commerce websites, financial institutions and brokerage firms.

Regardless of the text message lure used or brand used, the basic scam remains the same: After the visitor enters their payment information, the phishing site will automatically attempt to enroll the card as a mobile wallet from Apple or Google. The phishing site then tells the visitor that their bank is going to verify the transaction by sending a one-time code that needs to be entered into the payment page before the transaction can be completed.

If the recipient provides that one-time code, the scammers can link the victim’s card data to a mobile wallet on a device that they control. Researchers say the fraudsters usually load several stolen wallets onto each mobile device, and wait 7-10 days after that enrollment before selling the phones or using them for fraud.

Google called the scale of the Lighthouse phishing attacks “staggering.” A May 2025 report from Silent Push found the domains used by the Smishing Triad are rotated frequently, with approximately 25,000 phishing domains active during any 8-day period.

Google’s lawsuit alleges the purveyors of Lighthouse violated the company’s trademarks by including Google’s logos on countless phishing websites. The complaint says Lighthouse offers over 600 templates for phishing websites of more than 400 entities, and that Google’s logos were featured on at least a quarter of those templates.

Google is also pursuing Lighthouse under the Racketeer Influenced and Corrupt Organizations (RICO) Act, saying the Lighthouse phishing enterprise encompasses several connected threat actor groups that work together to design and implement complex criminal schemes targeting the general public.

According to Google, those threat actor teams include a “developer group” that supplies the phishing software and templates; a “data broker group” that provides a list of targets; a “spammer group” that provides the tools to send fraudulent text messages in volume; a “theft group,” in charge of monetizing the phished information; and an “administrative group,” which runs their Telegram support channels and discussion groups designed to facilitate collaboration and recruit new members.

“While different members of the Enterprise may play different roles in the Schemes, they all collaborate to execute phishing attacks that rely on the Lighthouse software,” Google’s complaint alleges. “None of the Enterprise’s Schemes can generate revenue without collaboration and cooperation among the members of the Enterprise. All of the threat actor groups are connected to one another through historical and current business ties, including through their use of Lighthouse and the online community supporting its use, which exists on both YouTube and Telegram channels.”

Silent Push’s May report observed that the Smishing Triad boasts it has “300+ front desk staff worldwide” involved in Lighthouse, staff that is mainly used to support various aspects of the group’s fraud and cash-out schemes.

An image shared by an SMS phishing group shows a panel of mobile phones responsible for mass-sending phishing messages. These panels require a live operator because the one-time codes being shared by phishing victims must be used quickly as they generally expire within a few minutes.

Google alleges that in addition to blasting out text messages spoofing known brands, Lighthouse makes it easy for customers to mass-create fake e-commerce websites that are advertised using Google Ads accounts (and paid for with stolen credit cards). These phony merchants collect payment card information at checkout, and then prompt the customer to expect and share a one-time code sent from their financial institution.

Once again, that one-time code is being sent by the bank because the fake e-commerce site has just attempted to enroll the victim’s payment card data in a mobile wallet. By the time a victim understands they will likely never receive the item they just purchased from the fake e-commerce shop, the scammers have already run through hundreds of dollars in fraudulent charges, often at high-end electronics stores or jewelers.

Ford Merrill works in security research at SecAlliance, a CSIS Security Group company, and he’s been tracking Chinese SMS phishing groups for several years. Merrill said many Lighthouse customers are now using the phishing kit to erect fake e-commerce websites that are advertised on Google and Meta platforms.

“You find this shop by searching for a particular product online or whatever, and you think you’re getting a good deal,” Merrill said. “But of course you never receive the product, and they will phish that one-time code at checkout.”

Merrill said some of the phishing templates include payment buttons for services like PayPal, and that victims who choose to pay through PayPal can also see their PayPal accounts hijacked.

A fake e-commerce site from the Smishing Triad spoofing PayPal on a mobile device.

“The main advantage of the fake e-commerce site is that it doesn’t require them to send out message lures,” Merrill said, noting that the fake vendor sites have more staying power than traditional phishing sites because it takes far longer for them to be flagged for fraud.

Merrill said Google’s legal action may temporarily disrupt the Lighthouse operators, and could make it easier for U.S. federal authorities to bring criminal charges against the group. But he said the Chinese mobile phishing market is so lucrative right now that it’s difficult to imagine a popular phishing service voluntarily turning out the lights.

Merrill said Google’s lawsuit also can help lay the groundwork for future disruptive actions against Lighthouse and other phishing-as-a-service entities that are operating almost entirely on Chinese networks. According to Silent Push, a majority of the phishing sites created with these kits are sitting at two Chinese hosting companies: Tencent (AS132203) and Alibaba (AS45102).

“Once Google has a default judgment against the Lighthouse guys in court, theoretically they could use that to go to Alibaba and Tencent and say, ‘These guys have been found guilty, here are their domains and IP addresses, we want you to shut these down or we’ll include you in the case.'”

If Google can bring that kind of legal pressure consistently over time, Merrill said, they might succeed in increasing costs for the phishers and more frequently disrupting their operations.

“If you take all of these Chinese phishing kit developers, I have to believe it’s tens of thousands of Chinese-speaking people involved,” he said. “The Lighthouse guys will probably burn down their Telegram channels and disappear for a while. They might call it something else or redevelop their service entirely. But I don’t believe for a minute they’re going to close up shop and leave forever.”

Affected products this month include the Windows OS, Office, SharePoint, SQL Server, Visual Studio, GitHub Copilot, and Azure Monitor Agent. The zero-day threat concerns a memory corruption bug deep in the Windows innards called CVE-2025-62215. Despite the flaw’s zero-day status, Microsoft has assigned it an “important” rating rather than critical, because exploiting it requires an attacker to already have access to the target’s device.

“These types of vulnerabilities are often exploited as part of a more complex attack chain,” said Johannes Ullrich, dean of research for the SANS Technology Institute. “However, exploiting this specific vulnerability is likely to be relatively straightforward, given the existence of prior similar vulnerabilities.”

Ben McCarthy, lead cybersecurity engineer at Immersive, called attention to CVE-2025-60274, a critical weakness in a core Windows graphic component (GDI+) that is used by a massive number of applications, including Microsoft Office, web servers processing images, and countless third-party applications.

“The patch for this should be an organization’s highest priority,” McCarthy said. “While Microsoft assesses this as ‘Exploitation Less Likely,’ a 9.8-rated flaw in a ubiquitous library like GDI+ is a critical risk.”

Microsoft patched a critical bug in Office — CVE-2025-62199 — that can lead to remote code execution on a Windows system. Alex Vovk, CEO and co-founder of Action1, said this Office flaw is a high priority because it is low complexity, needs no privileges, and can be exploited just by viewing a booby-trapped message in the Preview Pane.

Many of the more concerning bugs addressed by Microsoft this month affect Windows 10, an operating system that Microsoft officially ceased supporting with patches last month. As that deadline rolled around, however, Microsoft began offering Windows 10 users an extra year of free updates, so long as they register their PC to an active Microsoft account.

Judging from the comments on last month’s Patch Tuesday post, that registration worked for a lot of Windows 10 users, but some readers reported the option for an extra year of updates was never offered. Nick Carroll, cyber incident response manager at Nightwing, notes that Microsoft has recently released an out-of-band update to address issues when trying to enroll in the Windows 10 Consumer Extended Security Update program.

“If you plan to participate in the program, make sure you update and install KB5071959 to address the enrollment issues,” Carroll said. “After that is installed, users should be able to install other updates such as today’s KB5068781 which is the latest update to Windows 10.”

Chris Goettl at Ivanti notes that in addition to Microsoft updates today, third-party updates from Adobe and Mozilla have already been released. Also, an update for Google Chrome is expected soon, which means Edge will also be in need of its own update.

The SANS Internet Storm Center has a clickable breakdown of each individual fix from Microsoft, indexed by severity and CVSS score. Enterprise Windows admins involved in testing patches before rolling them out should keep an eye on askwoody.com, which often has the skinny on any updates gone awry.

As always, please don’t neglect to back up your data (if not your entire system) at regular intervals, and feel free to sound off in the comments if you experience problems installing any of these fixes.

[Author’s note: This post was intended to appear on the homepage on Tuesday, Nov. 11. I’m still not sure how it happened, but somehow this story failed to publish that day. My apologies for the oversight.]

At around 6:30 EST/11:30 UTC on Nov. 18, Cloudflare’s status page acknowledged the company was experiencing “an internal service degradation.” After several hours of Cloudflare services coming back up and failing again, many websites behind Cloudflare found they could not migrate away from using the company’s services because the Cloudflare portal was unreachable and/or because they also were getting their domain name system (DNS) services from Cloudflare.

However, some customers did manage to pivot their domains away from Cloudflare during the outage. And many of those organizations probably need to take a closer look at their web application firewall (WAF) logs during that time, said Aaron Turner, a faculty member at IANS Research.

Turner said Cloudflare’s WAF does a good job filtering out malicious traffic that matches any one of the top ten types of application-layer attacks, including credential stuffing, cross-site scripting, SQL injection, bot attacks and API abuse. But he said this outage might be a good opportunity for Cloudflare customers to better understand how their own app and website defenses may be failing without Cloudflare’s help.

“Your developers could have been lazy in the past for SQL injection because Cloudflare stopped that stuff at the edge,” Turner said. “Maybe you didn’t have the best security QA [quality assurance] for certain things because Cloudflare was the control layer to compensate for that.”

Turner said one company he’s working with saw a huge increase in log volume and they are still trying to figure out what was “legit malicious” versus just noise.

“It looks like there was about an eight hour window when several high-profile sites decided to bypass Cloudflare for the sake of availability,” Turner said. “Many companies have essentially relied on Cloudflare for the OWASP Top Ten [web application vulnerabilities] and a whole range of bot blocking. How much badness could have happened in that window? Any organization that made that decision needs to look closely at any exposed infrastructure to see if they have someone persisting after they’ve switched back to Cloudflare protections.”

Turner said some cybercrime groups likely noticed when an online merchant they normally stalk stopped using Cloudflare’s services during the outage.

“Let’s say you were an attacker, trying to grind your way into a target, but you felt that Cloudflare was in the way in the past,” he said. “Then you see through DNS changes that the target has eliminated Cloudflare from their web stack due to the outage. You’re now going to launch a whole bunch of new attacks because the protective layer is no longer in place.”

Nicole Scott, senior product marketing manager at the McLean, Va. based Replica Cyber, called yesterday’s outage “a free tabletop exercise, whether you meant to run one or not.”

“That few-hour window was a live stress test of how your organization routes around its own control plane and shadow IT blossoms under the sunlamp of time pressure,” Scott said in a post on LinkedIn. “Yes, look at the traffic that hit you while protections were weakened. But also look hard at the behavior inside your org.”

Scott said organizations seeking security insights from the Cloudflare outage should ask themselves:

1. What was turned off or bypassed (WAF, bot protections, geo blocks), and for how long?
2. What emergency DNS or routing changes were made, and who approved them?
3. Did people shift work to personal devices, home Wi-Fi, or unsanctioned Software-as-a-Service providers to get around the outage?
4. Did anyone stand up new services, tunnels, or vendor accounts “just for now”?
5. Is there a plan to unwind those changes, or are they now permanent workarounds?
6. For the next incident, what’s the intentional fallback plan, instead of decentralized improvisation?

In a postmortem published Tuesday evening, Cloudflare said the disruption was not caused, directly or indirectly, by a cyberattack or malicious activity of any kind.

“Instead, it was triggered by a change to one of our database systems’ permissions which caused the database to output multiple entries into a ‘feature file’ used by our Bot Management system,” Cloudflare CEO Matthew Prince wrote. “That feature file, in turn, doubled in size. The larger-than-expected feature file was then propagated to all the machines that make up our network.”

Cloudflare estimates that roughly 20 percent of websites use its services, and with much of the modern web relying heavily on a handful of other cloud providers including AWS and Azure, even a brief outage at one of these platforms can create a single point of failure for many organizations.

Martin Greenfield, CEO at the IT consultancy Quod Orbis, said Tuesday’s outage was another reminder that many organizations may be putting too many of their eggs in one basket.

“There are several practical and overdue fixes,” Greenfield advised. “Split your estate. Spread WAF and DDoS protection across multiple zones. Use multi-vendor DNS. Segment applications so a single provider outage doesn’t cascade. And continuously monitor controls to detect single-vendor dependency.”

Mozilla Monitor. Image Mozilla Monitor Plus video on Youtube.

In a statement published Tuesday, Mozilla said it will soon discontinue Monitor Plus, which offered data broker site scans and automated personal data removal from Onerep.

“We will continue to offer our free Monitor data breach service, which is integrated into Firefox’s credential manager, and we are focused on integrating more of our privacy and security experiences in Firefox, including our VPN, for free,” the advisory reads.

Mozilla said current Monitor Plus subscribers will retain full access through the wind-down period, which ends on Dec. 17, 2025. After that, those subscribers will automatically receive a prorated refund for the unused portion of their subscription.

“We explored several options to keep Monitor Plus going, but our high standards for vendors, and the realities of the data broker ecosystem made it challenging to consistently deliver the level of value and reliability we expect for our users,” Mozilla statement reads.

On March 14, 2024, KrebsOnSecurity published an investigation showing that Onerep’s Belarusian CEO and founder Dimitiri Shelest launched dozens of people-search services since 2010, including a still-active data broker called Nuwber that sells background reports on people. Shelest released a lengthy statement wherein he acknowledged maintaining an ownership stake in Nuwber, a data broker he founded in 2015 — around the same time he launched Onerep.

Superbox media streaming boxes for sale on Walmart.com.

Superbox bills itself as an affordable way for households to stream all of the television and movie content they could possibly want, without the hassle of monthly subscription fees — for a one-time payment of nearly $400.

“Tired of confusing cable bills and hidden fees?,” Superbox’s website asks in a recent blog post titled, “Cheap Cable TV for Low Income: Watch TV, No Monthly Bills.”

“Real cheap cable TV for low income solutions does exist,” the blog continues. “This guide breaks down the best alternatives to stop overpaying, from free over-the-air options to one-time purchase devices that eliminate monthly bills.”

Superbox claims that watching a stream of movies, TV shows, and sporting events won’t violate U.S. copyright law.

“SuperBox is just like any other Android TV box on the market, we can not control what software customers will use,” the company’s website maintains. “And you won’t encounter a law issue unless uploading, downloading, or broadcasting content to a large group.”

A blog post from the Superbox website.

There is nothing illegal about the sale or use of the Superbox itself, which can be used strictly as a way to stream content at providers where users already have a paid subscription. But that is not why people are shelling out $400 for these machines. The only way to watch those 2,200+ channels for free with a Superbox is to install several apps made for the device that enable them to stream this content.

Superbox’s homepage includes a prominent message stating the company does “not sell access to or preinstall any apps that bypass paywalls or provide access to unauthorized content.” The company explains that they merely provide the hardware, while customers choose which apps to install.

“We only sell the hardware device,” the notice states. “Customers must use official apps and licensed services; unauthorized use may violate copyright law.”

Superbox is technically correct here, except for maybe the part about how customers must use official apps and licensed services: Before the Superbox can stream those thousands of channels, users must configure the device to update itself, and the first step involves ripping out Google’s official Play store and replacing it with something called the “App Store” or “Blue TV Store.”

Superbox does this because the device does not use the official Google-certified Android TV system, and its apps will not load otherwise. Only after the Google Play store has been supplanted by this unofficial App Store do the various movie and video streaming apps that are built specifically for the Superbox appear available for download (again, outside of Google’s app ecosystem).

Experts say while these Android streaming boxes generally do what they advertise — enabling buyers to stream video content that would normally require a paid subscription — the apps that enable the streaming also ensnare the user’s Internet connection in a distributed residential proxy network that uses the devices to relay traffic from others.

Ashley is a senior solutions engineer at Censys, a cyber intelligence company that indexes Internet-connected devices, services and hosts. Ashley requested that only her first name be used in this story.

In a recent video interview, Ashley showed off several Superbox models that Censys was studying in the malware lab — including one purchased off the shelf at BestBuy.

“I’m sure a lot of people are thinking, ‘Hey, how bad could it be if it’s for sale at the big box stores?'” she said. “But the more I looked, things got weirder and weirder.”

Ashley said she found the Superbox devices immediately contacted a server at the Chinese instant messaging service Tencent QQ, as well as a residential proxy service called Grass IO.

GET GRASSED

Also known as getgrass[.]io, Grass says it is “a decentralized network that allows users to earn rewards by sharing their unused Internet bandwidth with AI labs and other companies.”

“Buyers seek unused internet bandwidth to access a more diverse range of IP addresses, which enables them to see certain websites from a retail perspective,” the Grass website explains. “By utilizing your unused internet bandwidth, they can conduct market research, or perform tasks like web scraping to train AI.” 

Reached via Twitter/X, Grass founder Andrej Radonjic told KrebsOnSecurity he’d never heard of a Superbox, and that Grass has no affiliation with the device maker.

“It looks like these boxes are distributing an unethical proxy network which people are using to try to take advantage of Grass,” Radonjic said. “The point of grass is to be an opt-in network. You download the grass app to monetize your unused bandwidth. There are tons of sketchy SDKs out there that hijack people’s bandwidth to help webscraping companies.”

Radonjic said Grass has implemented “a robust system to identify network abusers,” and that if it discovers anyone trying to misuse or circumvent its terms of service, the company takes steps to stop it and prevent those users from earning points or rewards.

Superbox’s parent company, Super Media Technology Company Ltd., lists its street address as a UPS store in Fountain Valley, Calif. The company did not respond to multiple inquiries.

According to this teardown by behindmlm.com, a blog that covers multi-level marketing (MLM) schemes, Grass’s compensation plan is built around “grass points,” which are earned through the use of the Grass app and through app usage by recruited affiliates. Affiliates can earn 5,000 grass points for clocking 100 hours usage of Grass’s app, but they must progress through ten affiliate tiers or ranks before they can redeem their grass points (presumably for some type of cryptocurrency). The 10th or “Titan” tier requires affiliates to accumulate a whopping 50 million grass points, or recruit at least 221 more affiliates.

Radonjic said Grass’s system has changed in recent months, and confirmed the company has a referral program where users can earn Grass Uptime Points by contributing their own bandwidth and/or by inviting other users to participate.

“Users are not required to participate in the referral program to earn Grass Uptime Points or to receive Grass Tokens,” Radonjic said. “Grass is in the process of phasing out the referral program and has introduced an updated Grass Points model.”

A review of the Terms and Conditions page for getgrass[.]io at the Wayback Machine shows Grass’s parent company has changed names at least five times in the course of its two-year existence. Searching the Wayback Machine on getgrass[.]io shows that in June 2023 Grass was owned by a company called Wynd Network. By March 2024, the owner was listed as Lower Tribeca Corp. in the Bahamas. By August 2024, Grass was controlled by a Half Space Labs Limited, and in November 2024 the company was owned by Grass OpCo (BVI) Ltd. Currently, the Grass website says its parent is just Grass OpCo Ltd (no BVI in the name).

Radonjic acknowledged that Grass has undergone “a handful of corporate clean-ups over the last couple of years,” but described them as administrative changes that had no operational impact. “These reflect normal early-stage restructuring as the project moved from initial development…into the current structure under the Grass Foundation,” he said.

UNBOXING

Censys’s Ashley said the phone home to China’s Tencent QQ instant messaging service was the first red flag with the Superbox devices she examined. She also discovered the streaming boxes included powerful network analysis and remote access tools, such as Tcpdump and Netcat.

“This thing DNS hijacked my router, did ARP poisoning to the point where things fall off the network so they can assume that IP, and attempted to bypass controls,” she said. “I have root on all of them now, and they actually have a folder called ‘secondstage.’ These devices also have Netcat and Tcpdump on them, and yet they are supposed to be streaming devices.”

A quick online search shows various Superbox models and many similar Android streaming devices for sale at a wide range of top retail destinations, including Amazon, BestBuy, Newegg, and Walmart. Newegg.com, for example, currently lists more than three dozen Superbox models. In all cases, the products are sold by third-party merchants on these platforms, but in many instances the fulfillment comes from the e-commerce platform itself.

“Newegg is pretty bad now with these devices,” Ashley said. “Ebay is the funniest, because they have Superbox in Spanish — the SuperCaja — which is very popular.”

Superbox devices for sale via Newegg.com.

Ashley said Amazon recently cracked down on Android streaming devices branded as Superbox, but that those listings can still be found under the more generic title “modem and router combo” (which may be slightly closer to the truth about the device’s behavior).

Superbox doesn’t advertise its products in the conventional sense. Rather, it seems to rely on lesser-known influencers on places like Youtube and TikTok to promote the devices. Meanwhile, Ashley said, Superbox pays those influencers 50 percent of the value of each device they sell.

“It’s weird to me because influencer marketing usually caps compensation at 15 percent, and it means they don’t care about the money,” she said. “This is about building their network.”

A TikTok influencer casually mentions and promotes Superbox while chatting with her followers over a glass of wine.

BADBOX

As plentiful as the Superbox is on e-commerce sites, it is just one brand in an ocean of no-name Android-based TV boxes available to consumers. While these devices generally do provide buyers with “free” streaming content, they also tend to include factory-installed malware or require the installation of third-party apps that engage the user’s Internet address in advertising fraud.

In July 2025, Google filed a “John Doe” lawsuit (PDF) against 25 unidentified defendants dubbed the “BadBox 2.0 Enterprise,” which Google described as a botnet of over ten million Android streaming devices that engaged in advertising fraud. Google said the BADBOX 2.0 botnet, in addition to compromising multiple types of devices prior to purchase, can also infect devices by requiring the download of malicious apps from unofficial marketplaces.

Some of the unofficial Android devices flagged by Google as part of the Badbox 2.0 botnet are still widely for sale at major e-commerce vendors. Image: Google.

Several of the Android streaming devices flagged in Google’s lawsuit are still for sale on top U.S. retail sites. For example, searching for the “X88Pro 10” and the “T95” Android streaming boxes finds both continue to be peddled by Amazon sellers.

Google’s lawsuit came on the heels of a June 2025 advisory from the Federal Bureau of Investigation (FBI), which warned that cyber criminals were gaining unauthorized access to home networks by either configuring the products with malicious software prior to the user’s purchase, or infecting the device as it downloads required applications that contain backdoors, usually during the set-up process.

“Once these compromised IoT devices are connected to home networks, the infected devices are susceptible to becoming part of the BADBOX 2.0 botnet and residential proxy services known to be used for malicious activity,” the FBI said.

The FBI said BADBOX 2.0 was discovered after the original BADBOX campaign was disrupted in 2024. The original BADBOX was identified in 2023, and primarily consisted of Android operating system devices that were compromised with backdoor malware prior to purchase.

Riley Kilmer is founder of Spur, a company that tracks residential proxy networks. Kilmer said Badbox 2.0 was used as a distribution platform for IPidea, a China-based entity that is now the world’s largest residential proxy network.

Kilmer and others say IPidea is merely a rebrand of 911S5 Proxy, a China-based proxy provider sanctioned last year by the U.S. Department of the Treasury for operating a botnet that helped criminals steal billions of dollars from financial institutions, credit card issuers, and federal lending programs (the U.S. Department of Justice also arrested the alleged owner of 911S5).

How are most IPidea customers using the proxy service? According to the proxy detection service Synthient, six of the top ten destinations for IPidea proxies involved traffic that has been linked to either ad fraud or credential stuffing (account takeover attempts).

Kilmer said companies like Grass are probably being truthful when they say that some of their customers are companies performing web scraping to train artificial intelligence efforts, because a great deal of content scraping which ultimately benefits AI companies is now leveraging these proxy networks to further obfuscate their aggressive data-slurping activity. By routing this unwelcome traffic through residential IP addresses, Kilmer said, content scraping firms can make it far trickier to filter out.

“Web crawling and scraping has always been a thing, but AI made it like a commodity, data that had to be collected,” Kilmer told KrebsOnSecurity. “Everybody wanted to monetize their own data pots, and how they monetize that is different across the board.”

SOME FRIENDLY ADVICE

Products like Superbox are drawing increased interest from consumers as more popular network television shows and sportscasts migrate to subscription streaming services, and as people begin to realize they’re spending as much or more on streaming services than they previously paid for cable or satellite TV.

These streaming devices from no-name technology vendors are another example of the maxim, “If something is free, you are the product,” meaning the company is making money by selling access to and/or information about its users and their data.

Superbox owners might counter, “Free? I paid $400 for that device!” But remember: Just because you paid a lot for something doesn’t mean you are done paying for it, or that somehow you are the only one who might be worse off from the transaction.

It may be that many Superbox customers don’t care if someone uses their Internet connection to tunnel traffic for ad fraud and account takeovers; for them, it beats paying for multiple streaming services each month. My guess, however, is that quite a few people who buy (or are gifted) these products have little understanding of the bargain they’re making when they plug them into an Internet router.

Superbox performs some serious linguistic gymnastics to claim its products don’t violate copyright laws, and that its customers alone are responsible for understanding and observing any local laws on the matter. However, buyer beware: If you’re a resident of the United States, you should know that using these devices for unauthorized streaming violates the Digital Millennium Copyright Act (DMCA), and can incur legal action, fines, and potential warnings and/or suspension of service by your Internet service provider.

According to the FBI, there are several signs to look for that may indicate a streaming device you own is malicious, including:

-The presence of suspicious marketplaces where apps are downloaded.
-Requiring Google Play Protect settings to be disabled.
-Generic TV streaming devices advertised as unlocked or capable of accessing free content.
-IoT devices advertised from unrecognizable brands.
-Android devices that are not Play Protect certified.
-Unexplained or suspicious Internet traffic.

This explainer from the Electronic Frontier Foundation delves a bit deeper into each of the potential symptoms listed above.

Scattered LAPSUS$ Hunters (SLSH) is thought to be an amalgamation of three hacking groups — Scattered Spider, LAPSUS$ and ShinyHunters. Members of these gangs hail from many of the same chat channels on the Com, a mostly English-language cybercriminal community that operates across an ocean of Telegram and Discord servers.

In May 2025, SLSH members launched a social engineering campaign that used voice phishing to trick targets into connecting a malicious app to their organization’s Salesforce portal. The group later launched a data leak portal that threatened to publish the internal data of three dozen companies that allegedly had Salesforce data stolen, including Toyota, FedEx, Disney/Hulu, and UPS.

The new extortion website tied to ShinyHunters, which threatens to publish stolen data unless Salesforce or individual victim companies agree to pay a ransom.

Last week, the SLSH Telegram channel featured an offer to recruit and reward “insiders,” employees at large companies who agree to share internal access to their employer’s network for a share of whatever ransom payment is ultimately paid by the victim company.

SLSH has solicited insider access previously, but their latest call for disgruntled employees started making the rounds on social media at the same time news broke that the cybersecurity firm Crowdstrike had fired an employee for allegedly sharing screenshots of internal systems with the hacker group (Crowdstrike said their systems were never compromised and that it has turned the matter over to law enforcement agencies).

The Telegram server for the Scattered LAPSUS$ Hunters has been attempting to recruit insiders at large companies.

Members of SLSH have traditionally used other ransomware gangs’ encryptors in attacks, including malware from ransomware affiliate programs like ALPHV/BlackCat, Qilin, RansomHub, and DragonForce. But last week, SLSH announced on its Telegram channel the release of their own ransomware-as-a-service operation called ShinySp1d3r.

The individual responsible for releasing the ShinySp1d3r ransomware offering is a core SLSH member who goes by the handle “Rey” and who is currently one of just three administrators of the SLSH Telegram channel. Previously, Rey was an administrator of the data leak website for Hellcat, a ransomware group that surfaced in late 2024 and was involved in attacks on companies including Schneider Electric, Telefonica, and Orange Romania.

A recent, slightly redacted screenshot of the Scattered LAPSUS$ Hunters Telegram channel description, showing Rey as one of three administrators.

Also in 2024, Rey would take over as administrator of the most recent incarnation of BreachForums, an English-language cybercrime forum whose domain names have been seized on multiple occasions by the FBI and/or by international authorities. In April 2025, Rey posted on Twitter/X about another FBI seizure of BreachForums.

On October 5, 2025, the FBI announced it had once again seized the domains associated with BreachForums, which it described as a major criminal marketplace used by ShinyHunters and others to traffic in stolen data and facilitate extortion.

“This takedown removes access to a key hub used by these actors to monetize intrusions, recruit collaborators, and target victims across multiple sectors,” the FBI said.

Incredibly, Rey would make a series of critical operational security mistakes last year that provided multiple avenues to ascertain and confirm his real-life identity and location. Read on to learn how it all unraveled for Rey.

WHO IS REY?

According to the cyber intelligence firm Intel 471, Rey was an active user on various BreachForums reincarnations over the past two years, authoring more than 200 posts between February 2024 and July 2025. Intel 471 says Rey previously used the handle “Hikki-Chan” on BreachForums, where their first post shared data allegedly stolen from the U.S. Centers for Disease Control and Prevention (CDC).

In that February 2024 post about the CDC, Hikki-Chan says they could be reached at the Telegram username @wristmug. In May 2024, @wristmug posted in a Telegram group chat called “Pantifan” a copy of an extortion email they said they received that included their email address and password.

The message that @wristmug cut and pasted appears to have been part of an automated email scam that claims it was sent by a hacker who has compromised your computer and used your webcam to record a video of you while you were watching porn. These missives threaten to release the video to all your contacts unless you pay a Bitcoin ransom, and they typically reference a real password the recipient has used previously.

“Noooooo,” the @wristmug account wrote in mock horror after posting a screenshot of the scam message. “I must be done guys.”

A message posted to Telegram by Rey/@wristmug.

In posting their screenshot, @wristmug redacted the username portion of the email address referenced in the body of the scam message. However, they did not redact their previously-used password, and they left the domain portion of their email address (@proton.me) visible in the screenshot.

O5TDEV

Searching on @wristmug’s rather unique 15-character password in the breach tracking service Spycloud finds it is known to have been used by just one email address: cybero5tdev@proton.me. According to Spycloud, those credentials were exposed at least twice in early 2024 when this user’s device was infected with an infostealer trojan that siphoned all of its stored usernames, passwords and authentication cookies (a finding that was initially revealed in March 2025 by the cyber intelligence firm KELA).

Intel 471 shows the email address cybero5tdev@proton.me belonged to a BreachForums member who went by the username o5tdev. Searching on this nickname in Google brings up at least two website defacement archives showing that a user named o5tdev was previously involved in defacing sites with pro-Palestinian messages. The screenshot below, for example, shows that 05tdev was part of a group called Cyb3r Drag0nz Team.

Rey/o5tdev’s defacement pages. Image: archive.org.

A 2023 report from SentinelOne described Cyb3r Drag0nz Team as a hacktivist group with a history of launching DDoS attacks and cyber defacements as well as engaging in data leak activity.

“Cyb3r Drag0nz Team claims to have leaked data on over a million of Israeli citizens spread across multiple leaks,” SentinelOne reported. “To date, the group has released multiple .RAR archives of purported personal information on citizens across Israel.”

The cyber intelligence firm Flashpoint finds the Telegram user @05tdev was active in 2023 and early 2024, posting in Arabic on anti-Israel channels like “Ghost of Palestine” [full disclosure: Flashpoint is currently an advertiser on this blog].

‘I’M A GINTY’

Flashpoint shows that Rey’s Telegram account (ID7047194296) was particularly active in a cybercrime-focused channel called Jacuzzi, where this user shared several personal details, including that their father was an airline pilot. Rey claimed in 2024 to be 15 years old, and to have family connections to Ireland.

Specifically, Rey mentioned in several Telegram chats that he had Irish heritage, even posting a graphic that shows the prevalence of the surname “Ginty.”

Rey, on Telegram claiming to have association to the surname “Ginty.” Image: Flashpoint.

Spycloud indexed hundreds of credentials stolen from cybero5dev@proton.me, and those details indicate that Rey’s computer is a shared Microsoft Windows device located in Amman, Jordan. The credential data stolen from Rey in early 2024 show there are multiple users of the infected PC, but that all shared the same last name of Khader and an address in Amman, Jordan.

The “autofill” data lifted from Rey’s family PC contains an entry for a 46-year-old Zaid Khader that says his mother’s maiden name was Ginty. The infostealer data also shows Zaid Khader frequently accessed internal websites for employees of Royal Jordanian Airlines.

MEET SAIF

The infostealer data makes clear that Rey’s full name is Saif Al-Din Khader. Having no luck contacting Saif directly, KrebsOnSecurity sent an email to his father Zaid. The message invited the father to respond via email, phone or Signal, explaining that his son appeared to be deeply enmeshed in a serious cybercrime conspiracy.

Less than two hours later, I received a Signal message from Saif, who said his dad suspected the email was a scam and had forwarded it to him.

“I saw your email, unfortunately I don’t think my dad would respond to this because they think its some ‘scam email,'” said Saif, who told me he turns 16 years old next month. “So I decided to talk to you directly.”

Saif explained that he’d already heard from European law enforcement officials, and had been trying to extricate himself from SLSH. When asked why then he was involved in releasing SLSH’s new ShinySp1d3r ransomware-as-a-service offering, Saif said he couldn’t just suddenly quit the group.

“Well I cant just dip like that, I’m trying to clean up everything I’m associated with and move on,” he said.

The former Hellcat ransomware site. Image: Kelacyber.com

He also shared that ShinySp1d3r is just a rehash of Hellcat ransomware, except modified with AI tools. “I gave the source code of Hellcat ransomware out basically.”

Saif claims he reached out on his own recently to the Telegram account for Operation Endgame, the codename for an ongoing law enforcement operation targeting cybercrime services, vendors and their customers.

“I’m already cooperating with law enforcement,” Saif said. “In fact, I have been talking to them since at least June. I have told them nearly everything. I haven’t really done anything like breaching into a corp or extortion related since September.”

Saif suggested that a story about him right now could endanger any further cooperation he may be able to provide. He also said he wasn’t sure if the U.S. or European authorities had been in contact with the Jordanian government about his involvement with the hacking group.

“A story would bring so much unwanted heat and would make things very difficult if I’m going to cooperate,” Saif said. “I’m unsure whats going to happen they said they’re in contact with multiple countries regarding my request but its been like an entire week and I got no updates from them.”

Saif shared a screenshot that indicated he’d contacted Europol authorities late last month. But he couldn’t name any law enforcement officials he said were responding to his inquiries, and KrebsOnSecurity was unable to verify his claims.

“I don’t really care I just want to move on from all this stuff even if its going to be prison time or whatever they gonna say,” Saif said.

It is no secret that money expert Clark Howard loves all things Costco. It is easy to see why, with staples like their Tire Center and Optical Department, as well as a constant array of new inventory. 

As a superfan of Costco myself, I love walking through the store and discovering fresh, new products. Sometimes, these products are from top-name brands. Sometimes, they are from small, local companies. Regardless, it is all part of the fun.

New Products at Costco This Month

Each month, I will take a look at the newest Costco products. While the majority will be under $100, I will let you know if I find a particularly good deal. 

Remember: Costco products are not guaranteed to be there from month to month, so if you discover a new product that you can’t live without, snag it.

With the holidays up ahead, I am showcasing new items that are great for checking off the boxes on your to-do and gift lists.

Bella 12”x22” XL Griddle with Warming Tray

Why I chose this:

The robust cooking surface, paired with the warming tray that juts out from the center, really caught my eye as I was perusing new items. It features a ceramic nonstick coating, a dishwasher-safe warming tray, and the best part? It is made without PFAS, PFOA, PTFE, and Cadmium, making the nonstick surface a safer choice.

Costco is selling this in-club for $39.99 and $49.99 online. There is also a $2.99 shipping charge for this item when purchased online.

Cuisinart Power Blend Immersion Blender

Why I chose this:

This blender is perfect in both price and size for someone entering the immersion blender market or to give as a gift. It comes with a 3-cup prep-and-go container with a lid, a full-size whisk, and a 4-cup processor that can slice, shred, chop, and mix, all while being BPA-free.

The price is $39.99 in-club and $49.99 online. (There was a promo recently at Costco making these $29.99, but that has expired.) Amazon sells a similar one for $62.57, so even without the promo, this is a good deal.

NFL Chrome Hover Helmet

Why I chose this:

This would make an excellent gift for any football fan or for yourself. And perfect timing with the holiday season upon us. Costco sells this LED-lit helmet that hovers and rotates. There are a variety of teams to choose from, but many are currently out of stock. I reached out to Costco and was told that they will have more teams available soon. They have my beloved Buffalo Bills in stock, so I have added them to my wish list.

This is an online-only item and sells for $69.99. The price does include shipping.

Lite-Brite XL Touch & Mini Touch Combo Pack

Why I chose this:

Remember Lite-Brite? Well, it is still around, and this would be a great potential holiday gift for the young and the young at heart. You get two Lite-Brites, one is an XL and one is a mini, perfect for travel. This is recommended for ages 6+ and includes batteries!

This is an in-club only item at this time and costs $43.99.

Canvas Tote Gift Basket 106.36 OZ. (6.64 LBS)

Why I chose this:

This gift basket is sure to be a hit with the recipient as it contains a wide variety of goodies. Ranging from hummus to different types of olives and from sparkling cider to a jar of preserves. A nice sampling of everything in a reusable basket.

This is an in-club only item and costs $53.89.

Sharpie S-Gel Retractable Gel Pen, Medium Point 0.7 mm, 16-pack

Why I chose this:

When I was a kid, I always found a Sharpie in my Christmas stocking. It was the little things that made me happy and still do! Well, fast forward all these years, and we keep that tradition alive in my family. These Sharpie pens have a medium-point tip and a rubber grip, and this set contains blue and black ink pens. Oh, the best part, no bleeding and no smearing!

You receive 16 pens for $16.99, which comes to $1.06 per pen when purchased online. The in-club price is slightly lower at $14.99, which makes them $0.94 per pen.

Goodles Variety Pack 8/6 OZ (3 LBS)

Why I chose this:

I couldn’t figure out why people were clamoring around this one item. I talked to a lady who was loading several packs into her cart, and she gave me the rundown. Goodles are rich in nutrients and contain a high amount of protein in each serving. There are eight boxes of macaroni and cheese in each pack, with four boxes of “Cheddy Mac” and four of “Shella Good”.

Costco sells these in-club only for $15.99. At nearly $2 per box, this is a good deal. Amazon sells them for $3 per box, and Target sells them for $3.29 per box! Be sure to check this out. It will go fast!

FIGO Marinara Pasta Chips 10.58 OZ. (0.66 LB)

Why I chose this:

I cannot take all the credit for this one. I saw in a Costco chat room that people were flipping for these pasta chips, so I made a point to take a look on my recent visit. The pallet was already half empty and the associate said they just came in a week ago. I grabbed a bag to try, and they are a hit. They genuinely taste like marinara sauce on a piece of penne pasta, but crunchy like a chip! And not a single one was broken. Needless to say, I have a few people who want me to grab them a bag on my next visit… assuming they still have them. 

Costco sells this bag for $7.39 as an in-club-only item, and based on actually trying them, they absolutely live up to the hype.

FIFA World Cup 12 Day Advent Calendar

Why I chose this:

The FIFA World Cup is coming to the USA in 2026, and more specifically, Atlanta! Costco is selling this awesome Advent calendar to help count down. Each countdown day includes a collectible stainless steel pin.

This is an online-only item, and shipping is included! The cost is $36.99.

Snowman Family with LED Lights Set of 3

Why I chose this:

Have you met the snowmen? The snowmen family that is. Costco is selling this whimsical 3-pack of snowmen. There are a total of 435 lights that twinkle and catch your eye. These can be used both indoors and outdoors.

As of now, this is an in-club only item for $129.99.

Final Thoughts

This is just the tip of the iceberg for December. As of December 2, 2025, there are 295 new items at Costco this month.

Be sure to check back every month as we update this list. Can’t wait until next month? You can find even more great Costco deals at Clark Deals right now.

Not a Costco member? Check out these things that will pay for your Costco membership!

The post 10 Best New Products at Costco in December appeared first on Clark Howard.

Switching cell phone service providers is an easy way to save money on your monthly bills. With an unlocked phone, you can switch service providers as frequently as you’d like. Plus, you’ll nearly always be eligible for new customer deals when you switch.

In this article, I’ll share the best cell phone plan deals available in December 2025. Some deals are exclusively available to new customers, while others include new cell phone plans and features available to everyone.

The Best Cell Phone Plan Deals This Month

This month, we’ve found 14 cell phone service providers offering limited-time discounts, new customer offers and/or new plan perks. Below, you’ll see a quick list of each deal available in December:

• Boost Mobile:
  • Get an unlimited plan for $10/month for the first three months (new customers only)
  • Our Boost Mobile Review
• Consumer Cellular:
  • Two unlimited lines for $60; save an additional $5/month with AARP (senior citizens only)
  • Our Consumer Cellular Review
• Cricket Wireless:
  • New plans include more mobile hotspot data, cloud storage, and Mexico/Canada connectivity for lower prices
  • Our Cricket Wireless Review
• Google Fi Wireless
  • Save 50% on eligible unlimited plans for the first 12 months when you bring your own phone (new customers only)
  • Our Google Fi Wireless Review
• Mint Mobile:
  • Get any unlimited plan for $15/month for the first three months, six months or year of service (new customers only)
  • Save 30% on select annual plans with promo code YEAROFMINT (new customers only)
  • Save up to $20/month with any three-month plan when you switch to Mint Mobile (new customers only)
  • Get a year of unlimited service for $15/month when you purchase an eligible phone (new customers only)
  • Our Mint Mobile Review
• RedPocket Mobile:
  • 50% off your first three months of service or 25% off annual plans (new customers only)
  • Our RedPocket Mobile Review
• Simple Mobile:
  • New plans include more high-speed data, unlimited global texting and more
  • Our Simple Mobile Review
• Tello Mobile:
  • Unlimited plan now includes more high-speed data for the same price (50GB; up from 35GB)
  • Our Tello Mobile Review
• Total Wireless:
  • Save 50% on a single-line monthly unlimited plan when you bring your own phone (new customers only)
  • Our Total Wireless Review
• Tracfone:
  • New Tracfone Freedom plan includes unlimited data for $50/month
  • 10% Military Discount is available on monthly plans
  • Our Tracfone Review
• Twigby:
  • Save $5-$10/month for the first three months (new customers only)
  • Our Twigby Review
• Ultra Mobile:
  • New plans include more high-speed data, mobile hotspot data and international benefits
  • Save 50% on eligible annual plans; get a 4GB plan for $6.50/month or unlimited starting at $17/month (new customers only)
  • Save 25% on eligible six-month plans; get a 4GB plan for $11.17/month or unlimited starting at $29.17/month (new customers only)
  • Our Ultra Mobile Review
• US Mobile:
  • Get the annual Unlimited Premium plan for $13.92/month with code BF67 (new customers only)
  • Our US Mobile Review
• Visible:
  • Get the annual Visible+ Pro plan for 50% off ($18.75/month) with promo code BLACKFRIDAY50 (new customers only)
  • Save $6-$12/month on unlimited plans for 26 months with promo code SWITCH26 (new customers only)
  • Get a $5/month discount on Visible+ or Visible+ Pro when you create or join a Visible Inner Circle
  • Buy a refurbished phone from Back Market and save up to $12/month for the first 36 months (new customers only)
  • Our Visible Review

For more information on each deal, check out our detailed list of the best cell phone plan deals available now.

Final Thoughts

If you’re switching to take advantage of a limited-time deal, be sure to cancel your service before the plan renews or be prepared to pay normal prices once the deal expires. You can check out our full list of tips on how to switch cell phone carriers here.

You can also use our free Phone Plan Finder to quickly compare the most affordable plans that will meet your needs.

Did we miss a plan on our list, or did you find a better deal? Let us know in our Clark.com Community!

The post The Best Cell Phone Plan Deals in December appeared first on Clark Howard.

The Transportation Security Administration (TSA) has announced a new fee-based option for travelers who fail to present an acceptable form of identification at airport security checkpoints.

Beginning February 1, 2026, any passenger who does not have a REAL ID-compliant driver’s license, U.S. passport, or other acceptable ID will be referred to a new identity verification process called TSA Confirm.ID — and it comes with a $45 price tag.

The Costly Last Resort: TSA Confirm.ID

If you want to fly domestically and do not have an acceptable ID, you will be directed to the optional TSA Confirm.ID process to establish your identity.

• Cost: $45 per person.
• Duration: This fee grants you access to the verification system for a 10-day travel period.
• Downside: TSA explicitly warns that travelers using the Confirm.ID process should expect delays at the airport.

The new fee is a direct consequence of the full enforcement of the REAL ID Act, which has been in effect since May 7, 2025.

The REAL ID Act requires travelers to present a REAL ID-compliant driver’s license (marked by a star on the card) or another federally approved form of identification to board commercial flights. If your current state-issued driver’s license is not REAL ID-compliant, you will not be permitted through security unless you use an alternative, such as a U.S. Passport or now, the $45 TSA Confirm.ID option.

What Is an Acceptable ID?

The easiest and cheapest ways to fly are by presenting one of the following:

• REAL ID-compliant State Driver’s License/ID
• U.S. Passport or Passport Card
• DHS Trusted Traveler Cards (Global Entry, NEXUS, SENTRI, FAST)
• U.S. Military ID

You can find the full list of acceptable IDs on the official TSA website.

Final Thoughts

This new $45 charge is completely avoidable. You should not have to pay extra money just to get through airport security.

Here are your two best options to avoid this new fee and potential delays:

Get Your REAL ID Now

If you haven’t done so, schedule an appointment with your state’s Department of Motor Vehicles (DMV) or equivalent agency. Bring all the required documentation to complete the process.

Use a Passport

If you have a valid U.S. Passport, you are already covered. Keep it ready for domestic travel. For frequent travelers, a U.S. Passport Card or Global Entry Card is also highly recommended, as they fit easily in your wallet and are REAL ID compliant.

The post New TSA $45 Fee for Travelers Without REAL ID appeared first on Clark Howard.

Are you in the market for a new credit card? If so, you’re probably looking for a card that gives you some immediate returns on your spending via a lucrative welcome bonus offer.

In this article, I will walk you through some of our favorite bonus offers for December 2025, along with our top credit card recommendations.

Best Credit Card Bonus Offers for December 2025

American Express Platinum Card® card_name Bonus Offer: As High As 175,000 points. Find Out Your Offer. Bonus Offer Disclaimer: You may be eligible for as high as 175,000 Membership Rewards® Points after spending $8,000 in eligible purchases on your new Card in your first 6 months of Membership. Welcome offers vary and you may not be eligible for an offer. Annual Fee: $895 (See Rates & Fees) Why We Like This Bonus Offer: If you qualify for the highest offer, you could earn $1,750 worth of travel booked through the Amex Travel portal. You may be able to find even better value through points transfer partners.

Capital One Venture Rewards Credit Card card_name Bonus Offer: 75,000 Miles Bonus Offer Disclaimer: once you spend $4,000 on purchases within 3 months from account opening Annual Fee: $95 Why We Like This Bonus Offer: The bonus offers a total value of $750 in rewards if redeemed on travel. That’s a great offer from a $95 annual fee card.

Capital One Savor Cash Rewards Credit Card card_name Bonus Offer: Earn $300 in welcome bonuses Bonus Offer Disclaimer: with a limited-time $100 Capital One Travel credit, plus earn $200 cash bonus with $500 spend within 3 months from account opening Annual Fee: $0 Why We Like This Bonus Offer: Earning up to $300 on a bonus from a no-annual-fee card is great, plus you can likely find a long-term home in your wallet for this one on dining and groceries.

You can read our full analysis of welcome bonus offers here.

Our Top Credit Card Recommendations

If you are in the market for a rewards credit card, you likely are looking to optimize either cash back rewards or travel rewards.

Here are the cards we recommend most often for each scenario:

If you want cash back on your everyday purchases:

We suggest one of these two no-annual-fee credit cards that offer unlimited 2% cash back with no hurdles to redeem your rewards.

Wells Fargo Active Cash® Card Learn More → Annual Fee: $0.00 Rewards Program Details: Earn unlimited 2% cash rewards on purchases with no categories to track or quarterly activations. Bonus Offer: Earn a $200 cash rewards bonus when you spend $500 in purchases in the first 3 months.

Synchrony Premier World Mastercard® Learn More → Annual Fee: $0 Rewards Program Details: 2% Cash Back on Every Purchase: Your cash back is unlimited and gets credited to your statement every month, automatically.

NOTE: If you already have a 2% cash back on everything card, use our cash back credit card tool to get even more cash back.

If you travel and want to maximize your travel rewards:

Capital One Venture X Rewards Credit Card card_name Annual Fee: $395 Rewards Program Details: 2 Miles per dollar on every purchase, every day. 10 Miles per dollar on hotels and rental cars booked through Capital One Travel. 5 Miles per dollar on flights and vacation rentals booked through Capital One Travel. Bonus Offer: 100,000 Miles Bonus Offer Disclaimer: when you spend $10,000 on purchases in the first 6 months from account opening Top Card Perks: $300 Annual Travel Credit: Receive a $300 annual credit for bookings through Capital One Travel, where you’ll get Capital One’s best prices on thousands of trip options 10,000 Miles Anniversary Bonus: Get 10,000 bonus miles (equal to $100 towards travel) every year, starting on your first anniversary Global Entry or TSA PreCheck® Credit: Receive up to a $120 credit for Global Entry or TSA PreCheck® Capital One Lounges: Enjoy access to 1,300+ lounges worldwide, including Capital One Lounge locations and Priority Pass lounges, after enrollment

Looking for more options? We have a full list of the best rewards credit cards and best travel credit cards.

Do you have a card recommendation? We’d love to hear which cards are making you the happiest in the Clark.com community.

To see the rates and fees for the American Express cards featured, please visit the following links: American Express Platinum Card®: See Rates and Fees.

Not all available financial products and offers from all financial institutions have been reviewed by this website.

All information about Wells Fargo Active Cash® Card has been collected independently by Clark Howard, Inc.

Clark.com and CardRatings may receive a commission from some card issuers, and may earn compensation when a customer clicks on a link, when an application is approved, or when an account is opened.

The post Best Credit Card Bonuses and Recommendations in December appeared first on Clark Howard.

US Mobile is celebrating Black Friday this year with “The 67 Deal.” Beginning on Black Friday at 11 a.m., new customers joining US Mobile can get the annual Unlimited Premium plan for $167 ($13.92/month) for the first year. 

In this article, I’ll share everything you need to know about US Mobile’s latest deal. I’ll include what you’ll get for the price and how US Mobile’s Black Friday deal compares to new-customer offers from affordable providers. 

Save $223 on US Mobile’s Annual Unlimited Premium Plan

US Mobile (Team Clark’s Review) is offering a major discount on its top-tier annual unlimited plan for Black Friday: $223 off! That brings the plan price to $167 for 12 months of service ($13.92/month). 

This deal will be available to new customers switching to US Mobile beginning on Black Friday after 11 a.m. Eastern. 

When you join US Mobile, choose the annual Unlimited Premium plan on the Light Speed network. You’ll also need to port your current phone number. Then, use the promo code BF67 to get this deal.

Here’s what you’ll get with US Mobile’s Unlimited Premium plan on the Light Speed network:

• Unlimited nationwide talk and text
• Unlimited high-speed 5G data
• 50GB of mobile hotspot data
• Up to 20GB of international roaming
• 200 minutes & 250 texts in 180+ countries
• Free network transfers

To learn more about US Mobile’s latest deal, visit the company’s website. 

US Mobile: An Affordable Cell Phone Service Provider on Any Network

If you aren’t familiar with US Mobile, it’s an MVNO (mobile virtual network operator) that partners with all three major networks to provide service to its customers. You can learn more about US Mobile’s different networks here.

US Mobile offers one of the cheapest overall phone plans at $96/year ($8/month) for unlimited talk, text and 2GB of high-speed data. Annual plans begin at $17.50/month ($210 upfront) when you prepay for a year of service. However, with the latest Black Friday offer, you can buy an annual Unlimited Premium plan for $13.92/month. This is a great deal for truly unlimited high-speed data compared to other unlimited plans.

To see how US Mobile’s Black Friday deal compares, I looked at current discounts on unlimited annual plans from some of our other favorite affordable providers:

• Mint Mobile (Team Clark’s Review): The annual unlimited plan costs $360 at regular rates. Mint Mobile’s current new customer offer ($15/month for any unlimited plan) brings the price to $180 for an annual plan. It includes unlimited high-speed data on T-Mobile’s network (speeds may slow after 35GB/month due to network congestion), as well as 10GB of mobile hotspot data. 
• Ultra Mobile (Team Clark’s Review): Annual unlimited plans begin at $408 at regular rates. Ultra Mobile’s current Black Friday deal (50% off annual plans) brings the price to $204 ($17/month) for the first year. The Ultra Unlimited plan includes all the same features as Mint Mobile’s unlimited plan, as well as a few additional international perks.
• Visible (Team Clark’s Review): Visible+ Pro costs $450 annually at regular rates. Visible’s current Black Friday deal (50% off with promo code BLACKFRIDAY50) brings the price to $225/year ($18.75/month). The plan includes unlimited premium data on Verizon’s 5G Ultra Wideband network, unlimited mobile hotspot (15Mbps) and two Global Pass days per month.

As you can see, you’ll get excellent value with US Mobile’s annual Unlimited Premium plan. This is especially true if you take advantage of the current Black Friday discount for new customers.

If you’re thinking about switching to US Mobile, bring your own unlocked phone to save the most money. You can also check your coverage on all three networks to see which one will provide the best service. However, the current Black Friday discount is only available on the Light Speed network.

To learn more before deciding to make the switch, be sure to read our full US Mobile review. 

For more options, check out all of our top picks for the best cell phone plans and deals available now. If you do decide to switch to a new cell phone service provider, check out this guide that Team Clark put together. It will take you step by step through the process of changing carriers.

Are you thinking about switching to US Mobile? Let us know in our Clark.com Community!

The post US Mobile Deal: Annual Unlimited Premium Under $14/Month appeared first on Clark Howard.

You’ve probably heard someone brag about their incredible investment returns. Maybe it was a coworker who doubled their money in crypto, or a relative who swears by their rental properties, or that guy at the barbecue who has a “can’t miss” opportunity he wants to tell you about.

Here’s what they’re not telling you: Every penny of extra return they’re chasing comes with extra risk attached. There’s no way around it.

The Starting Line: The Safest Money in America

Let’s start with the absolute safest place to put your money in the United States: government bonds and FDIC-insured bank accounts.

When you buy a US Treasury bond, you’re lending money to the federal government. The only way you don’t get paid back is if the United States government defaults on its debt. That’s never happened in over 200 years, and if it does, we’ll all have much bigger problems than our investment returns.

Right now, you can get around 4-5% on short-term Treasury bills, and similar rates on FDIC-insured high-yield savings accounts and CDs. That’s your baseline. That’s what safe money earns.

Everything else we’re going to talk about offers higher potential returns. And every single one comes with more risk than government bonds and FDIC-insured accounts.

Corporate Bonds: You’re Betting on a Company, Not a Country

Corporate bonds work like government bonds, except you’re lending to a company instead of the government. Companies can go bankrupt. Governments that print their own currency can’t.

High-quality corporate bonds from companies like Apple or Microsoft might pay you 1-2 percentage points more than Treasury bonds. That extra return compensates you for the small but real chance that the company could fail.

Bonds from shakier companies (called “high-yield” or “junk” bonds) might pay you 5-8 percentage points more than Treasuries. That’s not generosity. That’s the market pricing in a meaningful risk that the company won’t be able to repay you.

The risk: You could lose some or all of your money if the company goes bankrupt. Bondholders get paid before stockholders in bankruptcy, but that doesn’t mean you’ll get all your money back.

Stock Market Index Funds: Betting on the Whole Economy

Broad-market index funds, such as those that track the S&P 500, have returned about 10% annually over the long run. That’s roughly double what safe government bonds typically return.

Why the premium? Because even with diversification across hundreds of companies, you’re still taking on real risks:

• Stock prices swing based on economic conditions, corporate earnings, and investor sentiment.
• There’s no guaranteed return. You might make 30% one year and lose 20% the next.
• You could buy at the wrong time and wait years, even a decade or more, to break even.

Look at 2022: the S&P 500 dropped 18%. If you needed that money for a house down payment or your kid’s tuition, too bad. It was gone. (It came back in 2023, but you had to wait and stomach the loss.)

Or consider someone who invested at the peak in 2000. They had to wait until 2013 to get back to even. That’s 13 years of going nowhere. If you bought in 2007, you didn’t break even until 2013 either. Six years of waiting.

The risk: You’re exposed to overall market crashes and economic downturns. But unlike individual stocks, you won’t lose everything because one company fails. Your main risk is timing and patience. Over the long term, the market has always gone up and to the right. But “long term” might mean you need to wait out a lost decade.

Individual Company Stocks: Bigger Swings, Bigger Risks

Individual stocks can deliver returns that blow away index funds. Nvidia, for example, has absolutely crushed the S&P 500’s returns over the past few years. If you bought it at the right time, you might have multiplied your money several times over.

But here’s what you’re taking on:

• Company-specific risk: Bad management, product failures, competition, accounting scandals, or industry disruption can tank a stock regardless of what the overall market does.
• Concentration risk: Your returns depend on the success of a single company rather than hundreds.
• Total loss potential: Companies can go bankrupt. Enron, Lehman Brothers, and thousands of other stocks have gone to zero.

Remember that for every Nvidia, there are stocks that disappoint or fail. General Electric was once the most valuable company in the world. Sears was Amazon before Amazon existed. BlackBerry dominated smartphones until it didn’t.

The risk: You could lose everything if the company fails. Even if it doesn’t fail, you could badly underperform the market if you pick the wrong one. Yes, you might pick the next Nvidia. But you might also pick the next Bed Bath & Beyond.

REITs: Real Estate Without the Tenants

Real Estate Investment Trusts (REITs) let you invest in real estate without buying property directly. You buy shares that trade on the stock market, and the REIT owns and manages the actual buildings.

REITs have historically returned 9-11% annually, similar to stocks. They pay dividends from rental income, but their value also goes up and down, just like stocks.

The risk: REITs are just as volatile as stocks, sometimes more so. When interest rates rise, REITs often take a hit because property values drop and borrowing costs rise. In 2022, the REIT index fell by about 25%. You also have concentration risk since you’re betting heavily on one sector of the economy. And despite owning “real estate,” you can’t live in a REIT or fix a leaky roof to protect your investment.

Real Estate: It’s Not as Safe as People Think

Real estate investing is popular because it feels tangible. You can see it, touch it, and drive by it. That doesn’t make it low-risk.

If you’re buying a rental property, you’re taking on:

• Vacancies where you have no income but still have expenses.
• Repairs that can cost thousands with no warning.
• Problem tenants who might not pay or might damage your property.
• Local market risk (the neighborhood could decline).
• Concentration risk (your wealth is tied up in one or two properties).
• Liquidity risk (you can’t instantly sell a house if you need money).

Real estate investors target returns in the 8-12% range annually when you factor in rental income and appreciation. That’s higher than bonds because the risks are greater.

Read more: Ways to invest in real estate

Small Business and Angel Investing: High Risk, High Reward (Maybe)

Investing in a friend’s startup or becoming an angel investor in early-stage companies can sound exciting. The pitch is tempting: get in on the ground floor of the next big thing.

The reality is sobering. Most small businesses fail within the first few years. Even among venture-backed startups with professional investors involved, the majority either fail or return less money than you put in.

The risk: You could easily lose 100% of your investment. Your money is locked up for years with no way to get it back early. You have no control over how the business is run. There’s no public market price, so you don’t even know what your investment is worth most of the time. Success stories make headlines, but failures stay quiet. For every friend who invested early in a winning company, there are dozens who invested in companies that went nowhere.

Peer-to-Peer Lending: You’re the Bank Now

Peer-to-peer lending platforms let you lend money directly to individuals who need personal loans. You might see promised returns of 5-7% or even higher.

Sounds great, right? You’re cutting out the bank and collecting the interest yourself. But there’s a reason banks charge the rates they do and have entire departments dedicated to underwriting loans.

The risk: Individual borrowers default at much higher rates than government or large corporations do. When someone doesn’t pay back their loan, you lose that money. You also can’t easily sell these loans if you need your money back. The platforms themselves could also fail, and some have.

Gold: You’re Betting It’ll Be Worth More to Someone Else

Gold doesn’t pay dividends. It doesn’t generate earnings. It just sits there, shiny and inert. Its value is based entirely on what someone else will pay you for it later.

Over the very long run, gold has roughly kept pace with inflation. Sometimes it soars (like in 2020-2021 and 2025). Sometimes it goes nowhere for decades (like from 1980 to 2000).

The risk: Gold can be extremely volatile, and there’s no underlying earnings or cash flow to provide a floor on its value. You’re speculating on supply, demand, fear, and sentiment.

Cryptocurrency: Maximum Volatility

Crypto offers the potential for massive returns. It also offers the potential for massive losses, and unlike stocks, there are no underlying business earnings to fall back on.

Bitcoin has had years when it rose by 100%+ and years when it dropped by 70%+. Smaller cryptocurrencies are even more volatile, and many have gone to zero.

The risk: Extreme price swings, no intrinsic value, regulatory uncertainty, exchange failures, lost passwords, scams, and the real possibility that the crypto you buy could become worthless.

If someone made 500% in crypto, they took on an enormous risk to get there. For every person who got rich, others lost their shirts.

Private Investments and the “Guaranteed Return” Scam

Now we get to the dangerous stuff.

Someone approaches you with an investment opportunity. Maybe it’s a private company, a real estate syndication, or a friend’s business venture. They’re promising returns of 15%, 20%, or 30%.

Here’s the truth: If an investment could safely deliver those returns, wealthy institutions would have already bought up every penny of it. The fact that they’re coming to you should be a red flag.

These “opportunities” come with massive risks:

• No liquidity (your money is locked up, sometimes for years)
• No transparency (you can’t easily check the value)
• No regulation (fewer protections if something goes wrong)
• Fraud risk (Ponzi schemes often promise guaranteed high returns)
• Total loss risk (many private ventures fail completely)

And about those “guaranteed” returns your neighbor mentioned? Guaranteed by whom? If the investment goes bad, will they write you a check from their personal account? Of course not. There’s no guarantee.

The Uncomfortable Truth

Here’s what you need to accept: There is no secret investment that delivers high returns without high risk. If someone tells you differently, they’re either lying to you or lying to themselves.

The market is pretty efficient. Millions of investors, from individuals to massive institutions, compete for returns. When an investment offers a higher return, it’s because the market has collectively decided it’s riskier.

You want safe, guaranteed returns? You’re getting 4-5% from government bonds and FDIC-insured accounts.

You want 10-12% returns? You’re going to need to accept the volatility and risk of stocks or real estate.

You want 15-20% returns? You’re moving into speculative territory with small business investments, junk bonds, or volatile assets.

What This Means for Your Money

This doesn’t mean you should only invest in the safest options. For most people, taking on some risk through a diversified stock portfolio makes sense, especially if you won’t need the money for many years.

But it does mean you need to be honest about what you’re signing up for. If you invest in stocks, you need to be prepared for years when your account drops 20% or more. If you invest in rental property, you need to be ready for major repairs and tenant problems. If you dabble in crypto, you need to be okay with the possibility that your investment could go to zero.

And when someone pitches you on an investment promising outsized returns with minimal risk? You should run in the other direction. They’re either clueless about how investing works or they’re running a scam.

The only free lunch in investing is diversification. Everything else is a tradeoff between risk and return. The sooner you accept that, the better your financial decisions will be.

The post Want Higher Investment Returns? There’s Only One Way appeared first on Clark Howard.

Yet another smaller cruise line just filed for bankruptcy. And I said “another” because there’s been a plague of this lately. We’re seeing it with smaller cruise lines sailing out of U.S. ports, those that sail overseas, tour operators, and even riverboat cruises.

While we’re talking about companies going out of business, a number of small airlines around the world have gone bust, and frankly, there are several in the United States that are not in great financial shape. So I want to talk about a critical way to protect your money and make sure you don’t get left holding the bag if a travel company goes under.

The Red Flag: Luring You To Pay by Check or Cash

There is something they’re asking you to do that I absolutely do not want you to do.

I don’t want you being lured in by a tour operator or a cruise line saying, “Hey, you pay us by check and we’re going to give you a 5% discount, or a 7% discount, or a 3% discount,” or whatever the discount is. When the discount is significantly higher than their credit card processing costs — which for a travel supplier doing big-ticket items is usually about 1.5% — that’s a giant red flag.

If they’re suddenly offering you a 5% or 7% discount for giving them your checking account number and letting them debit the money that way (ACH), here’s what’s really going on: They may be on “credit watch” from the credit card operators.

When a customer pays in, there’s a big “hold back.” The operator on credit watch doesn’t have access to most of the money you just paid them; they only get a small portion right away.

In order to keep the ship going or the tours touring, they try to get people booking future dates to pay by checking account. They get all of that money right away.

The Distinction That Really Matters

If that airline, cruise line, tour operator, or even a vacation rental company goes bust or flies the coop, and you paid by check or direct debit, your money is gone. There is absolutely no way for you to reclaim that money. No way to do it.

There are only two possible ways you can recapture that money:

Pay by Credit Card

While not completely ironclad and foolproof, paying by credit card is often the way you get your money restored to you.

The credit card industry has a big financial incentive to give you that money back. That way, you have an extra incentive going forward to pay for travel by credit card and they keep collecting all those merchant fees. It works for both of you.

Buy True Trip Insurance That Covers Supplier Default

If you buy a policy directly from the travel supplier, it is usually not real insurance — it’s their “protection plan.” And let me tell you, you are not protected from anything if they go bust.

With real third-party trip insurance, some policies do cover the supplier going bust, but others don’t.

If protecting yourself against a tour operator or cruise line default is your main goal, you must make sure the policy covers it before you give up your period of review.

Because trip insurance is regulated by the states, you will have a look-see period (maybe 15 days or 30 days) where you can say, “Thanks, but no thanks, I want my money back for the policy.” Use that time to review the fine print! You want to make sure it covers protecting all the money you paid in from the supplier going bust.

Final Thoughts

Just be aware and be wary when somebody is dangling a little discount in front of you for paying cash. They are not being your friend in the travel business, at least not where your wallet is concerned.

The post Warning: The Travel Discount That Is NOT Worth The Risk appeared first on Clark Howard.

One of the most important decisions you’ll make as an investor has nothing to do with picking individual stocks or timing the market. It’s about deciding how much of your portfolio to allocate to bonds versus stocks.

This single decision will likely determine most of your investment returns over time. Get it right, and you’ll sleep well at night while still building wealth. Get it wrong, and you might panic-sell at the worst possible moment or miss out on decades of growth.

The problem? There’s no shortage of advice on this topic, and much of it contradicts itself. Some experts say you need 40% in bonds. Others say you need none at all. Warren Buffett famously recommends just 10% in cash for his wife’s inheritance.

Meanwhile, some retirees swear by keeping three years of expenses in cash.

So which approach is right for you? Let’s break down the most popular bond allocation strategies and help you find the one that fits your situation.

Why Bonds Matter in the First Place

Before diving into the rules, it helps to understand what bonds actually do in your portfolio.

Stocks offer higher long-term returns but come with significant volatility. In a bad year, your stock portfolio might drop 30% or more. In a terrible year like 2008, it could fall closer to 50%.

Bonds generally provide lower returns but with much less volatility. When stocks crash, bonds often hold steady or even rise in value. This smooths out your overall portfolio performance and gives you something stable to draw from during market downturns.

The trade-off is simple: more bonds mean lower volatility but lower expected returns. Fewer bonds means higher expected returns but a bumpier ride.

The Classic 60/40 Portfolio

The 60/40 portfolio is the granddaddy of asset allocation strategies. It calls for 60% stocks and 40% bonds, and it’s been the default recommendation from financial advisors for decades.

The appeal of 60/40 is its balance. Historically, this mix has delivered roughly 70-80% of stock market returns with significantly less volatility. During the 2008 financial crisis, a 60/40 portfolio lost about 20% while an all-stock portfolio dropped nearly 40%.

However, the 60/40 portfolio has faced criticism in recent years. When interest rates were near zero, bonds offered minimal returns while still dragging down overall portfolio performance. And in 2022, both stocks and bonds fell significantly at the same time, an event that rarely occurs historically.

Who it might work for: The 60/40 portfolio remains a reasonable choice for investors who want a simple, set-it-and-forget-it approach with moderate risk. It’s particularly popular among those within 10 years of retirement who want to start dialing back volatility without getting too conservative.

The Age in Bonds Rule (And Why It Changed)

One of the oldest rules of thumb in investing says you should hold bonds equal to your age. If you’re 30, you’d hold 30% bonds. At 60, you’d hold 60% bonds.

The logic is intuitive: as you get older, you have less time to recover from market crashes, so you should gradually shift toward safer investments.

The problem? This rule was created when people retired at 65 and life expectancy was much shorter. Someone retiring today might live another 30 years or more. Holding 65% in bonds at retirement could mean your portfolio doesn’t keep pace with inflation over such a long time horizon.

That’s why many financial experts now recommend a modified version: your age minus 10 or even your age minus 20 in bonds. Under the “age minus 20” version, a 60-year-old would hold just 40% in bonds rather than 60%.

Who it might work for: The modified age-in-bonds rule appeals to investors who want a systematic approach that automatically becomes more conservative over time. It’s simple to implement and removes the guesswork from asset allocation decisions. The “age minus 20” version works well for those comfortable with more volatility who want to maximize growth potential.

The 50/15 Rule

Money expert Clark Howard’s 50/15 rule cuts through the complexity with a simple question: Do you expect to be alive in 15 years?

If the answer is yes, you should have at least 50% of your portfolio in stocks. That means no more than 50% in bonds, regardless of your age.

The logic is straightforward. Stocks have historically outperformed bonds over every 15-year period in modern market history. If you have at least 15 years ahead of you, you have enough time to ride out market downturns and benefit from the higher long-term returns that stocks provide. Going too heavy on bonds when you still have decades of life ahead means sacrificing growth you’ll likely need to outpace inflation.

This rule is particularly useful for retirees who might otherwise follow traditional age-based guidelines into overly conservative territory. A healthy 70-year-old with a 20-year life expectancy doesn’t need 70% in bonds. That level of conservatism could actually hurt them by failing to keep pace with rising costs over a long retirement.

Who it might work for: The 50/15 rule works well for anyone who wants a simple gut-check on their allocation. It’s especially valuable for retirees who worry they might be too conservative, given outdated rules that assumed shorter lifespans.

The Buffett Approach: 90/10 With Zero Bonds

Warren Buffett has given specific instructions for how his wife’s inheritance should be invested: 90% in a low-cost S&P 500 index fund and 10% in short-term government bonds or cash.

Notice what’s missing? Traditional bonds. Buffett’s recommendation essentially replaces bonds entirely with cash or cash equivalents.

His reasoning is straightforward. Over long periods, stocks dramatically outperform bonds. The 10% in cash isn’t there to generate returns. It’s there to provide liquidity and peace of mind so you never have to sell stocks during a downturn.

This approach requires an iron stomach. During a 40% market crash, a 90/10 portfolio would drop about 36%. You’d need the discipline not to panic and sell. But if you can stay the course, a higher stock allocation should deliver significantly better returns over the long term.

Who it might work for: The 90/10 approach suits investors with a long time horizon, stable income, high risk tolerance, and the emotional discipline to ignore market volatility. It’s not for everyone, but for those who can handle it, the math tends to work in their favor.

The Three Years in Cash Approach

Some retirees take an entirely different strategy: Keep three years of living expenses in cash or cash equivalents, then invest the rest entirely in stocks.

The psychology behind this is powerful. If you have three years of expenses sitting in a savings account or money market fund, you know you can weather any market crash without touching your investments. The stock market has never taken more than about three years to recover from its worst crashes, so in theory, you’d never be forced to sell low.

This approach can actually be more aggressive than it sounds. If your portfolio is large relative to your expenses, the “rest in stocks” portion might be 80%, 90%, or even more of your total assets.

Who it might work for: The three-years-in-cash strategy appeals to retirees who want maximum growth potential but need the psychological security of knowing their near-term expenses are covered regardless of what the market does. It requires disciplined annual rebalancing to maintain the three-year cash cushion.

How To Choose Your Bond Allocation

With all these options, how do you pick the right one? Consider these factors:

Your time horizon matters most. If you won’t touch this money for 20+ years, you can afford to take more risk with a lower bond allocation. If you need the money within five years, you should lean heavily toward bonds and cash regardless of what any rule says.

Your risk tolerance is personal. Some people can watch their portfolio drop 40% and shrug it off. Others lose sleep over a 10% decline. Be honest with yourself about which camp you fall into. The best allocation is one you’ll actually stick with during a crisis.

Your other income sources provide context. If you have a pension, Social Security, or rental income that covers your basic expenses, you can afford to be more aggressive with your investment portfolio. If your portfolio is your only source of retirement income, more stability makes sense.

Your overall financial picture matters. A large emergency fund, low debt, and stable employment all give you more flexibility to take investment risk. Financial stress in other areas might warrant a more conservative allocation.

A Practical Framework for Deciding

If you’re still unsure, here’s a simple framework:

For investors more than 15 years from retirement with stable income and high risk tolerance, consider allocations between 10-20% bonds (closer to the Buffett approach).

For investors 5-15 years from retirement with moderate risk tolerance, consider allocations between 20-40% bonds (modified age rule or working toward the 50/15 guideline).

For investors within 5 years of retirement or already retired, consider allocations between 30-50% bonds (keeping Clark’s 50/15 rule in mind if you expect to live another 15+ years), or the three-years-in-cash approach if you prefer that framework.

For investors who want simplicity above all else, the 60/40 portfolio remains a time-tested option that requires minimal thought or adjustment.

The Most Important Thing

Whatever allocation you choose, the most important thing is that you actually stick with it. The perfect allocation on paper means nothing if you panic and sell everything during the next bear market.

Pick an approach you understand, that lets you sleep at night, and that you can commit to for the long haul. Then automate your contributions, rebalance once a year, and spend your mental energy on things other than checking your portfolio.

Your future self will thank you.

The post How To Choose the Right Bond Allocation for Your Portfolio appeared first on Clark Howard.

For a limited time, new Google Fi Wireless customers can save 50% on an unlimited plan for the first 12 months. That brings the monthly price to as low as $17.50 for one line! 

In this article, I’ll share everything you need to know about Google Fi Wireless’ latest deal, including who’s eligible, what you’ll get for the price and how the plans compare to other affordable providers.

Save Up to $25/Month on Google Fi Wireless’ Unlimited Plans

Google Fi Wireless (Team Clark’s Review) is currently offering a 50% discount on its Unlimited Essentials or Unlimited Standard plan. The deal is available to new customers who switch before December 5. Additionally, you’ll need to bring your own phone to be eligible. 

Here’s what you’ll get with each eligible plan: 

Unlimited Essentials

• Unlimited talk, text and data (30GB high-speed)
• Full connectivity for select smartwatches

Unlimited Standard

• Unlimited talk, text and data (50GB high-speed)
• Full connectivity for select smartwatches
• 25GB of high-speed hotspot tethering
• Data, calls and texts within Canada and Mexico
• Free calls to Canada and Mexico from the US

At regular rates, Unlimited Essentials costs $35/month for a single line, with multiline discounts bringing the price to as low as $23/month per line for 4+ lines. Alternatively, Unlimited Standard costs $50/month for one line at regular rates, with multiline discounts, bringing the price to as low as $25/month per line for 4+ lines. 

Google Fi Wireless’ current promotion applies to both single-line and multiline accounts. If you join with multiple lines, each person will need to bring their own phone and choose an eligible plan to receive the discount. 

In the table below, you can see the monthly discounted prices per line for Unlimited Essentials and Unlimited Standard.

Once you activate your service, you’ll automatically receive the discount for the first 12 months. After 12 months, plan rates will return to normal. 

To learn more before you decide to make the switch, be sure to read our full Google Fi Wireless review. For more information on the latest deal, visit the company’s website here. 

Google Fi Wireless: An Affordable T-Mobile MVNO

If you aren’t familiar with Google Fi Wireless, it’s a mobile virtual network operator (MVNO) that utilizes T-Mobile’s service towers. At Clark.com, we recognize Google Fi Wireless as the best overall international phone plan. 

Compared to T-Mobile’s postpaid cell phone plans, Google Fi Wireless offers excellent prices. For a single line, T-Mobile’s postpaid unlimited plans begin at $50 with autopay (plus taxes & fees). While you’ll get 20GB of additional premium data with T-Mobile’s Essentials Saver (compared to Google Fi Wireless’ Unlimited Essentials), there are no additional perks.

The same T-Mobile plan is available for four lines for $100/month. At regular rates, Google Fi Wireless’ Unlimited Essentials is $10 cheaper for four lines. However, with the current promotion, you can get four lines on Unlimited Standard for $50/month for the first 12 months. It includes the same amount of high-speed data as T-Mobile’s Essentials, plus smartwatch connectivity, data in Mexico/Canada, and 25GB of mobile hotspot. 

Compared to other prepaid cell phone service providers on T-Mobile’s network, Google Fi Wireless still offers competitive prices. While single lines with unlimited data can find better deals with other service providers at regular rates, the current 50% discount makes Google Fi Wireless much more competitive. To compare, here are a few of our other favorite unlimited plans that utilize the same service towers: 

• Mint Mobile (Team Clark’s Review): For a limited time, new customers can get an unlimited plan for $15/month when prepaying for three months, six months or a year. The same plan is available annually for $30/month at regular rates. It includes unlimited data (speeds may slow with network congestion after 35GB) as well as 10GB of mobile hotspot. 
• US Mobile (Team Clark’s Review): On the Light Speed network, monthly unlimited plans begin at $25 for 70GB of high-speed data and 10GB of mobile hotspot data. Annually, the same plan is available for $270 ($22.50/month) at regular rates.
• Tello Mobile (Team Clark’s Review): For $25/month, customers can get an unlimited data plan that includes 50GB of high-speed data and 10GB of hotspot data. However, after 50GB of data usage, speeds will be throttled (significantly reduced) until the next billing cycle.

Be sure to check out our full Google Fi Wireless review before you purchase a plan. If you do decide to switch to Google Fi Wireless, check out our step-by-step guide to changing cell phone service providers first.

For more options, check out all of our top picks for the best cell phone plans available now. Additionally, you can use our new Cell Phone Plan Finder to quickly compare plans that will meet your needs.

Are you thinking about switching to Google Fi Wireless? Let us know in our Clark.com Community!

The post Google Fi Wireless Deal: 50% off Unlimited for 12 Months appeared first on Clark Howard.

Owning a second home feels instantly appealing: a personal retreat, a gathering spot for family, maybe even a way to build wealth. But while the dream is easy to picture, the reality can be more complicated and expensive than it looks.

Before you start browsing listings, it’s worth thinking carefully about what questions you need to answer first.

1. How Often Will You Actually Use It?

Be realistic. Work schedules, kids’ activities, and travel costs all compete for your time. List every season, school break, and holiday for the next year. How many times could you truly visit?

• Rule of thumb: If you won’t use it at least 6 to 8 weeks a year, compare the cost to simply renting.
• Travel friction: The farther it is, the less you’ll go. A four-hour drive feels fine now but quickly becomes a barrier.
• Seasonality test: Visit during the off-season to see how the area feels when it’s quiet or cold.

Then there’s vacation guilt. Once you buy, every other trip feels “wrong” because you’re paying for a place you’re not using. If you love variety and trying new places, owning a fixed getaway might make you feel tied down instead of free.

2. Can You Handle the Full Financial Picture?

A second home comes with more than just another mortgage payment. Create a full annual budget:

• Fixed costs: Mortgage, property taxes, insurance, HOA dues, utilities, trash, internet, and pest control.
• Hidden costs: Maintenance reserve (1–2% of property value per year), furniture and setup, travel to the home, and property management fees.

Example: A $500,000 vacation home with 20% down and a 7% mortgage could cost about $47,000 per year, before you even travel there.

If your numbers only work with optimistic rental income, you’re not buying a getaway. You’re running a hospitality business.

Before you close:

• Vacation-home loans require higher credit and down payments than primary mortgages.
• Test your payment if rates rise 1–2 percentage points.
• Keep 6–12 months of carrying costs in cash, separate from your regular emergency fund.
• Verify insurance early. In some regions, insurers are limiting new policies or leaving entirely. If you can’t get affordable coverage, the entire purchase may not make sense.

3. Do Local Rules Fit Your Plans?

Every community has its own restrictions: short-term rental limits or bans, permit requirements, lodging taxes, and HOA rules about guests, noise, or parking. What’s allowed today can change. Build flexibility into your plan.

4. Are You Ready to Run a Rental Business?

If you’re counting on rent, treat it like a business, because it is one.

• Occupancy: Plan for 40–50% actual use, not 100%.
• Management: Full-service property managers often take 20–30% of rent.
• Costs: Cleaning, supplies, turnover, taxes, and repairs eat into profits.

Even a “low-maintenance” property needs eyes on it. Identify local repair people and cleaners before you buy. Budget for someone to check after storms or in the off-season. If you manage rentals yourself, factor in your time. Every guest message, repair call, and review takes hours.

5. Do You Understand the Tax Rules?

The IRS limits deductions based on how much you rent versus how much you use it personally. Many localities require registration and monthly filings. And if you own property out of state, you may owe taxes in multiple states. Always confirm with a qualified tax professional before counting on deductions.

6. What Else Could This Money Do?

Before locking in a large down payment, consider alternatives such as paying off your primary mortgage faster, maxing out retirement accounts, investing in a diversified portfolio, or building a larger emergency fund. Ask yourself: Would renting different places for a few years bring the same joy for less cost and more flexibility?

7. Is Everyone in the Family on Board?

A second home only works if it fits everyone’s priorities, not just today’s, but tomorrow’s too.

The cabin that feels magical when your kids are ten might feel empty when they’re sixteen, spending weekends with friends or working part-time. If you’re thinking long term, ask yourself how this home will fit your family five, ten, or twenty years from now.

Talk openly: Who will actually use the home? Who’s responsible for cleaning, maintenance, and costs? If this is meant to be a “legacy home,” who inherits both the memories and the expenses?

8. What’s Your Exit Plan?

Vacation markets can cool quickly. Know how long you’d need to hold the home to feel comfortable selling, and be prepared to carry it for a year or more if the market slows or your life changes.

A 5-Minute Self-Test

Can you answer “yes” to all five questions below? If so, a second home might be right for you. If not, slow down.

• Will I use this home for at least 6–8 weeks each year for the next five years?
• Can I afford it without rental income?
• Do I have 6–12 months of cash to cover costs?
• Is insurance available and affordable?
• Do I have a clear exit plan if my circumstances change?

Final Thoughts

Money expert Clark Howard says a second home can bring joy, but only if it’s a decision made with clear eyes, not wishful thinking. If your finances are in great shape and you’ll genuinely use and love the place, it can be a rewarding choice. But if you’re chasing a dream that mostly lives in your imagination, consider renting the experience instead.

The post So You Think You Want a Second Home? appeared first on Clark Howard.