Group-IB analysts record 5-fold increase in the number of crypto scam domains

What’s new? Cybersecurity firm Group-IB published a report in which it reported that in the first half of 2022 the number of domains used for crypto scams increased by 5 times. According to experts, 63% of new scam domains were created on Russian platforms, but almost all resources were aimed at international crypto investors. Experts noted that the top 5 most popular domain zones used by crypto scam websites were .com (31,65%), .net (23,86%), .org (22,94%) and .us (5,89%).

Group-IB’s report

What did analysts record? In February 2022, an active increase in the number of scam streams on YouTube was first noticed, that allegedly involved famous entrepreneurs, such as Ethereum co-founder Vitalik Buterin, Tesla and SpaceX CEO Elon Musk, and MicroStrategy board chairman Michael Saylor. In such projects, scammers impersonate famous personalities by creating streams from old recordings or even using deepfakes. Herewith, they may advertise fake crypto projects, announce cryptocurrency giveaways, and offer investors a doubling of the amount invested. The report noted:

“Paired combinations are also frequently used among domain names. For example, ‘shiba’ + ‘musk’ or ‘musk’ + ‘twitter.’ In addition, postfixes such as ‘gift,’ ‘give,’ ‘crypto,’ ‘coin’ and ‘invest’ were popular.”

Experts found that the main channel for attracting traffic to fake websites is YouTube. Scammers tried to use the Twitch video streaming service. The average number of viewers, including the boosted bots, is 10 000-20 000. To conduct fake streams, scammers buy channels on the dark web or hack them, as recently happened with the famous rapper Lil Nas X.

On September 3, hackers hacked the South Korean government’s YouTube channel, renamed it SpaceX Invest, and posted a broadcast on it with Elon Musk’s deepfake discussing cryptocurrencies. During the online presentation of Apple’s new tech, the crypto scammers launched their own live stream, which aired a recording of an old interview with the company’s CEO Tim Cook. Under the video, was a phishing link disguised as Apple’s official website.