Executive Summary 🔗︎
The growing popularity of cryptocurrencies has led to the rise of frauds and scams against those who use them. As with any other type of cyber-enabled fraud, people are often sold on some seemingly unbeatable offer via social media or email. However, this often results in great losses to those hasty enough to fall for such scams.
Different possible angles exist to performing cryptocurrency-related fraud investigations. For example, one could perform a follow-the-money investigation to determine where the money paid to defrauders by their victims went, in the hope of attributing the scheme to a specific individual in the real world.
In the present case, we will take an exploratory approach to unmasking fraudsters and dismantling their schemes, without looking at the financials. To do this, we will look into reports made by Reddit users and attempt to determine whether there is truth behind scheme allegations.
Social media, particularly forums like Reddit, often represent rich sources of information for preliminary investigations into all sorts of fraud schemes. Maltego can easily and quickly query these types of websites for information that can then be used to pivot into actual internet infrastructure such as the websites hosting the alleged fraud schemes or whois data, which helps determine the legitimacy of the intent behind a website registration. Additionally, with its analysis capabilities, Maltego can be used to enrich data with risk scores of several types to help carrying out due diligence during the investigation.
Discovering and Investigating Fake Crypto Exchanges 🔗︎
The goal of the following workflow is to use Maltego and its integrations with social media to discover fraudulent schemes targeting people interested in crypto investments and – more specifically – crypto exchanges.
Hub Items that will be of use for this investigation are the Maltego Standard Transforms, DomainTools Iris and WhoisXML API. We will also use a customized view developed by the analyst which allows an easier visualization of domain risk scores usually added as Entity properties and thus, hard to visualize on the Graph.
Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!
Happy investigating!
