Can we find Internet properties linked to crypto giveaway scams by using Maltego and WhoisXML transforms?

By Alexandre François, Head of Marketing & Security Researcher at WhoisXML API

Maltego Investigation Part 1 -- Study of a March 2021 IoC.

Crypto giveaway scams are nothing new, yet they recently re-emerged as per this news article https://www.bbc.com/news/technology-56402378 published on March 16, 2021.

The IoC cited in the article is elonpromo[.]site.

Let’s start Maltego and see what can be uncovered with WhoisXML transforms.

Step 1: Addition of “elonpromo.site” as a domain.

Step 2: Gather WHOIS records with “WHOIS Records Lookup” + “Extract Fields From WHOIS Records” for “Registrant Email” and “Registrant Name”.

We’ve been lucky so far. Though the Registrant Name is generic (i.e., the city “Moscow”), we did identify a public email address “[email protected][.]ru” that can be used as a pivotal point. Interestingly, we identified this email address with a mere “WHOIS Lookup” as opposed to a Historical WHOIS Lookup.

This means that even with today’s common redaction of records, notably driven by GDPR, the registrant did not bother to keep their email address private and the WHOIS record has an updated date specified “2021-03-10” and therefore is recent.

Can we find more from here? Let’s give it a shot.

Step 3: Let’s do a “Reverse WHOIS Records Search” for “[email protected][.]ru” to see if we can find any identified connected domains.

Yes, we did identify a connected domain for this email address. This leads to a series of questions. For instance, when was it registered? Was it also used for crypto scams?

To answer this question, we:

Step 4: Run a “Historical WHOIS records” and find two historical records with updated date 2021-02-25.

Step 5: Run “Snapshots between Dates” by using Wayback Machine specified between 20210201 and 20210630.

Step 6: Opening one of those objects identified by the Wayback Machine, we find this URL https://web.archive.org/web/20210221231437if_/https://www.chamath-event.site/

Visiting it, we get a screenshot that convincingly looks like a crypto scam:

Maltego Investigation Part 2 -- Footprint Expansion of a List of Crypto Scam IoCs from 2018

In this article, Proofpoint specified a list of 30 registrant email addresses linked to Crypto scams. What can we learn from those email addresses by using Maltego and WhoisXML API transforms?

Step 1: Run an Historical Reverse WHOIS query on those 30 email addresses, which gives us a footprint of over 120 domains:

Step 2: Run an Historical WHOIS query on those 120+ domains, which shows a large number of WHOIS records:

Some of those domains have an established WHOIS History -- e.g., cryptorocket[.]com have records dating back to 2018 (i.e, when Proofpoint investigation was written) up until very recently, 2021-06-14:

Looking into each of those records is beyond the scope of this short investigation. The data gathered can, however, be made available upon request.

Feel free to reach out to me at [email protected] to discuss this or other investigations you may wish to carry out using WhoisXML API datasets.