Down the Domain Research Rabbit Hole

Let's face it, being anonymous is hard if you're managing a large volume of scams. You have to be able to hide your tracks really well and assume no one is going to take the time to go far enough down the rabbit hole to find anything useful.

Turns out, I'm on vacation this week, and what better way to spend it then heading down a rabbit hole.

Pivoting from the 12 domains and the email addresses mentioned in the last post, it looks like there are several similar domains using the same name server.  That brings the full list to:

  • bin-core[.]com
  • bit-camp[.]com
  • bit-cron[.]com
  • bit-ext[.]com
  • bit-green[.]com
  • bit-investor[.]com
  • bit-thor[.]com
  • camp-bit[.]com
  • camp-token[.]com
  • chain-bit[.]com
  • coin-bin[.]com
  • cron-bit[.]com
  • crypto-floor[.]com
  • ext-bit[.]com
  • first-token[.]com
  • flow-bit[.]com
  • link-token[.]com
  • market-token[.]com
  • more-bit[.]com
  • set-bit[.]com
  • temp-bit[.]com
  • token-club[.]com
  • token-next[.]com
  • token-smart[.]com
  • vrytex[.]com
  • wall-bit[.]com
If these domains weren't so similar I might dismiss them for having been associated with the previous sites via the name server, but that pattern with the hyphen is just too compelling to be a coincidence.

The one outlier is vrytex[.]com, and that one is also registered with ovidiilapin2872@list.ru.




Vrytex[.]com has been associated with some trading scams and only been registered since January 8th 2022.  Perhaps at one point they were attempting to create a legitimate crypto exchange, but given the association with all the above sites my guess is that it was always meant to be some kind of fly by night scam exchange.

There's a fairly recent reddit post on vrytex[.]com here:
https://www.reddit.com/r/Scams/comments/s1nvo3/vrytex_global_is_a_crypto_scam/

It seems if you sign up your account appears to be credited with BTC, but you have to deposit more money before you can withdraw.  However, you never really own the BTC.  At best this is a centralized cryptocurrency exchange.  Not your keys, not your crypto. With an honest centralized cryptocurrency exchange, you might not have your keys but you trust the exchange is keeping an accurate ledger and is holding crypto on your behalf that you can withdraw at any time.

With a dishonest or scam centralized exchange, you can't actually withdraw anything, and if you deposit the centralized exchange might make it seem like you have funds in your account, but really you'll never be able to withdraw them.  You're just giving them your money.

If anyone knows anything about the wallets associated with this exchange it might be time to pivot over to some block chain analysis to see if we can learn more about how they operate.


Comments

Popular posts from this blog

Down MetaMask Impersonation Rabbit Hole

NameSilo Abuse Reporting

More Sites Taken Down