Unmasking a Network of Crypto Trading Scam Platforms

A recent investigation by Norwegian news outlet NRK highlighted the story of a victim who fell prey to an elaborate investment fraud scheme using the website VRC-Markets[.]com. The victim, believing they were making legitimate investments, unknowingly transferred funds to a fraudulent platform. This case is not an isolated incident; it is part of a broader trend of crypto trading scams that lure victims with the promise of high returns, only to disappear with their money.

What Are Crypto Trading Scam Platforms?

Crypto trading scam platforms pose as legitimate investment websites, often mimicking real trading platforms. These fraudulent sites convince users to deposit money, sometimes even providing a fake trading interface to simulate investment gains. Victims are often contacted through phone calls (voice phishing) or online advertisements, making them believe they are engaging with a trustworthy financial service.

Our OSINT Investigation

Following the NRK report, DataExpert’s investigators conducted an Open-Source Intelligence (OSINT) investigation into VRC-Markets[.]com, one of the fraudulent trading websites mentioned in the article. Using public data sources, we uncovered a network of interconnected scam websites that share striking similarities, pointing to a possible coordinated scam operation.

Patterns in Scam Domains

Our investigation revealed several key patterns that link these fraudulent platforms:

1. Reused Background Images – Many of these websites used the same background images, suggesting a common source or template.
2. Identical Icons and UI Elements – The graphical elements, including buttons, logos, and trading interface designs, were found to be reused across multiple scam domains. 
3. Whois Information Similarities – In some cases, the same (historical) registrant details appeared across multiple sites, indicating that they may be operated by the same group or individual. 
4. Shared IP Addresses – Several of these domains were hosted on the same IP address, reinforcing the connection between them. 
5. Phone Numbers Linked to Voice Phishing – The scammers target victims via phone calls, often originating from numbers previously reported for fraudulent activity in Nordic countries.

The Bigger Picture

This network of scam crypto trading or investment websites is not limited to one region; similar patterns have been observed in different parts of the world, such as the Nordics and the United Kingdom. The shift towards direct payments on these fraudulent platforms, rather than through reputable cryptocurrency exchanges, makes it harder for victims to recover lost funds. Although a large part of the websites behind these domains are currently offline, they can be reused later on. The same goes for reusing certain backgrounds or icons.

Key Takeaways

Our OSINT investigation into these fraudulent crypto trading platforms has highlighted patterns such as reused website templates, identical UI elements, and suspicious (historical) whois- or hosting details which can indicate, in this case, a possible scamming website. By raising awareness and sharing insights with our customers, DataExpert helps prevent financial losses and is making it harder for scammers to operate.

List of Associated domains*

*More domains were found during the investigation. However, since these where offline for a longer period of time or for sale, we decided to leave these out of the list.