Tracking Down Fake Cryptocurrency Sellers Using DNS Intelligence

The cryptocurrency market has grown over the years. In fact, the market capitalization peaked at US$3 trillion in November 2021, experiencing subsequent ups and downs before reaching US$2.58 trillion in March 2024.¹ And while this trend is good, it may also spell bad news—more threat actors are bound to initiate crypto-centered scams.

The WhoisXML API research team was recently alerted to fake cryptocurrency-selling campaigns. We analyzed 130 domains believed to belong to fake crypto sellers. Our IoC expansion analysis found more than 2,700 potentially connected artifacts comprising:

• 522 email-connected domains, 21 of which turned out to be malicious
• 41 IP addresses, 39 of which turned out to be associated with various threats
• 259 IP-connected domains
• 1,947 string-connected domains, 15 of which are already tagged as malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.forbes.com/advisor/in/investing/cryptocurrency/why-is-crypto-going-up/