You have been redirected from paterva.com. Maltego.com is the new home for all information regarding Maltego products. Read more about this in a message from the Paterva team and in this blog post and FAQ. close

Investigating Fake Crypto Exchanges with Maltego, DomainTools & WhoisXML API

Executive Summary 🔗︎

The growing popularity of cryptocurrencies has led to the rise of frauds and scams against those who use them. As with any other type of cyber-enabled fraud, people are often sold on some seemingly unbeatable offer via social media or email. However, this often results in great losses to those hasty enough to fall for such scams.

Different possible angles exist to performing cryptocurrency-related fraud investigations. For example, one could perform a follow-the-money investigation to determine where the money paid to defrauders by their victims went, in the hope of attributing the scheme to a specific individual in the real world.

In the present case, we will take an exploratory approach to unmasking fraudsters and dismantling their schemes, without looking at the financials. To do this, we will look into reports made by Reddit users and attempt to determine whether there is truth behind scheme allegations.

Social media, particularly forums like Reddit, often represent rich sources of information for preliminary investigations into all sorts of fraud schemes. Maltego can easily and quickly query these types of websites for information that can then be used to pivot into actual internet infrastructure such as the websites hosting the alleged fraud schemes or whois data, which helps determine the legitimacy of the intent behind a website registration. Additionally, with its analysis capabilities, Maltego can be used to enrich data with risk scores of several types to help carrying out due diligence during the investigation.

Discovering and Investigating Fake Crypto Exchanges 🔗︎

The goal of the following workflow is to use Maltego and its integrations with social media to discover fraudulent schemes targeting people interested in crypto investments and – more specifically – crypto exchanges.

Hub Items that will be of use for this investigation are the Maltego Standard Transforms, DomainTools Iris and WhoisXML API. We will also use a customized view developed by the analyst which allows an easier visualization of domain risk scores usually added as Entity properties and thus, hard to visualize on the Graph.

Download the resource
By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

Download
Resource Now
arrow
Pick the right product and get started.