TLDR
This week's ScamVerify™ threat report covers the current state of scam intelligence across all channels. The database now tracks 11 million+ threat records: 7.7 million FTC complaints, 2.9 million phone summaries, 352,000 FCC complaints, 74,032 URLhaus malicious domains, and 60,758 ThreatFox indicators of compromise. New scam ring activity continues in the 844-523 and 833-588 prefixes. The fastest-rising number is (877) 578-4104 at 49 complaints per day. The all-time most reported number remains (877) 200-2515 with 3,258 combined complaints. URLhaus data shows that .com domains account for 81% of all malicious URLs.
Database Overview: March 23, 2026
| Data Source | Record Count | Change This Week |
|---|---|---|
| FTC Consumer Complaints | 7,700,000+ | Growing via daily sync |
| Phone Number Summaries | 2,900,000+ | Aggregated from FTC + FCC |
| FCC Consumer Complaints | 352,000+ | Weekly sync active |
| URLhaus Malicious Domains | 74,032 | Updated via automated sync |
| ThreatFox IOCs | 60,758 | Updated via automated sync |
| Community Reports | Growing | User-submitted |
| Total Threat Records | 11,000,000+ |
These records power every lookup across all six ScamVerify verification channels: phone, website, text, email, document, and QR code.
Active Scam Rings This Week
844-523 Ring: 132 Numbers, 4,086 Complaints
The largest active scam ring in our database continues operating with 132 sequential toll-free numbers in the 844-523 prefix. All numbers are concentrated in debt reduction robocalls with an 89% robocall rate. The ring acquires numbers in bulk from VoIP providers, cycles through them as numbers get flagged, and replaces blocked numbers with new ones from the same sequential block.
For the full analysis, see our 844-523 scam ring investigation.
833-588 Ring: 31 Numbers, 3,538 Complaints
A smaller but highly active ring using the 833-588 prefix has accumulated 3,538 complaints across 31 numbers. That is an average of 114 complaints per number, indicating high call volume and aggressive campaigns. The ring focuses on debt reduction and medical-related scams.
Details in our 833-588 ring exposure.
Other Active Rings
| Ring Prefix | Numbers | Total Complaints | Primary Category |
|---|---|---|---|
| 833-487 | 135 | 7,728 | Debt reduction |
| 866-959 | 32 | 4,717 | Debt reduction |
| 855-909 | 36 | 3,969 | Debt reduction |
All five active rings share common characteristics: toll-free number prefixes, sequential number acquisition, debt reduction as the primary subject, and robocall rates above 85%.
Fastest-Rising Numbers
The numbers accumulating complaints at the fastest rate this week:
| Phone Number | Complaints/Day | Total | Primary Subject |
|---|---|---|---|
| (877) 578-4104 | 49/day | Rising | Debt reduction |
| (844) 523-XXXX series | 30+/day across ring | 4,086 | Debt reduction |
| (833) 588-XXXX series | 25+/day across ring | 3,538 | Medical/debt |
Fast-rising numbers indicate active campaigns. If you receive calls from numbers with these prefixes, they are almost certainly part of ongoing scam operations. Check any number at ScamVerify phone lookup.
Most Reported Number: (877) 200-2515
The all-time most reported number in the ScamVerify database remains (877) 200-2515 with 3,258 combined FTC and FCC complaints. This toll-free number has been associated with debt reduction robocalls since at least 2023 and continues generating complaints despite its high profile.
Read the full analysis in our (877) 200-2515 investigation.
URLhaus Domain Analysis
The URLhaus malicious domain data reveals consistent patterns in how scammers build infrastructure:
Top-Level Domain Distribution
| TLD | Count | Percentage |
|---|---|---|
| .com | 59,876 | 81.0% |
| .top | 2,814 | 3.8% |
| .xyz | 1,628 | 2.2% |
| .net | 1,405 | 1.9% |
| .info | 893 | 1.2% |
| Other | 7,416 | 9.9% |
| Total | 74,032 | 100% |
The dominance of .com is significant. It means the old advice of "avoid websites with unusual extensions" is dangerously misleading. 81% of malicious domains use .com, the most trusted extension. Domain extension alone is useless as a safety indicator.
What This Means for QR Code Scams
QR codes that link to malicious sites will predominantly lead to .com domains. A URL like secure-banking-update.com or parking-pay-online.com looks legitimate at a glance. Without checking against the URLhaus database, a .com domain receives undeserved trust.
FTC Complaint Categories This Week
The top complaint categories in the FTC database, reflecting the most common scam types Americans report:
| Category | Complaints | Robocall Rate |
|---|---|---|
| Debt reduction | 935,542 | 89% |
| Impersonation | 684,045 | 72% |
| Medical/prescriptions | 312,847 | 85% |
| Warranties/protection plans | 287,693 | 91% |
| Dropped/no message | 276,441 | N/A |
| Energy/utility | 189,234 | 78% |
| Charity | 65,553 | 74% |
Debt reduction continues to dominate, representing nearly one million complaints. These calls are highly automated (89% robocall rate), indicating large-scale operations using auto-dialers and pre-recorded messages.
Cross-Channel Threat Landscape
Scams are increasingly multi-channel. A single campaign may use phone calls, text messages, emails, and QR codes simultaneously:
Phone to text pipeline: Scammer calls, victim does not answer, scammer follows up with a text message claiming to be a voicemail notification with a link.
Email to QR pipeline: Phishing email contains a QR code instead of a clickable link, bypassing email security filters.
Text to website pipeline: Smishing text contains a URL that leads to a credential harvesting site tracked in URLhaus.
Physical QR to website pipeline: Fake QR code stickers on parking meters, restaurant tables, and flyers direct victims to payment fraud sites.
This cross-channel approach is why ScamVerify operates verification across all six channels rather than focusing on phone numbers alone. A phone number that appears in FTC complaints may also be associated with text campaigns that link to URLhaus-tracked domains.
How to Use This Report
Check numbers before answering. If you receive a call from a toll-free number (800, 833, 844, 855, 866, 877, 888), check it on ScamVerifybefore engaging. Toll-free numbers are the primary vehicle for organized scam rings.
Forward suspicious emails to scan@scamverify.ai for AI-powered analysis.
Check QR codes at the QR scanner before scanning them, particularly in public spaces.
Report scam contacts to the FTC at reportfraud.ftc.gov. Every report strengthens the threat database that tools like ScamVerify rely on.
Check this number now
Enter any U.S. phone number to check it against 8 million+ federal complaints and real-time carrier data.
FAQ
How often is the ScamVerify threat database updated?
FTC complaint data syncs via automated Trigger.dev tasks. URLhaus and ThreatFox data are updated through automated sync processes. FCC data syncs weekly. The database is continuously growing as new complaints, threat indicators, and community reports are added.
Why are most scam ring numbers toll-free?
Toll-free numbers (800, 833, 844, 855, 866, 877, 888) are cheap to acquire in bulk from VoIP providers, can be used from any location, and appear more legitimate to recipients than random local numbers. Scam rings purchase sequential blocks of toll-free numbers and cycle through them as individual numbers get flagged and blocked.
What should I do if I see a number from one of the listed scam rings?
Do not answer. Do not call back. Block the number on your phone. Report it to the FTC at reportfraud.ftc.gov. Check the number on ScamVerify to see its full complaint history and associated patterns.
How can a .com domain be malicious?
The .com extension indicates only that a domain was registered through a .com registrar. It says nothing about the site's legitimacy or safety. Anyone can register a .com domain for a few dollars. Scammers register .com domains because they receive more trust from victims than unusual extensions like .xyz or .top. Always verify a domain through ScamVerify's website checker rather than trusting the extension.
