The situation
Over six weeks, the fraud intelligence unit of an international retail bank received 63 complaints from customers who had sent money to online "investment platforms". Customer losses had reached $2.3M. The sites were polished, promoted through fake endorsement advertising, and showed victims fabricated account balances that grew every day until a withdrawal was requested.
The bank's team had been reporting the sites to hosting providers and registrars. Each takedown worked for a few days. Then the same platform reappeared under a new domain, often with the same customer support scripts and the same promised returns.
The question
The bank asked three things. Are these sites one operation or many? If one, who runs it? And where does the money go? The answers had to support suspicious activity reporting and a referral to law enforcement, which meant every finding needed to be evidenced, reproducible and stated with an honest level of confidence.
What we did
A lead investigator, two infrastructure analysts, a financial investigator and a linguist worked the case. A red-team reviewer who took no part in the collection was assigned from day one.
1. Fixed and preserved the starting set
We began with the 14 domains named in customer complaints. Each was captured in full, including page source, scripts and network requests, then timestamped and SHA-256 hashed in Aldervane Capture before any analysis began. Three of the 14 were already offline, so we recovered and preserved archived copies from web archives.
2. Pivoted on shared infrastructure
Every one of the 14 sites loaded the same third-party analytics container identifier. Identifiers like this are issued per account, so their reuse across unrelated-looking sites is a strong operational link. Searching historical crawl data for that one identifier returned 212 domains registered over 22 months.
Certificate history then grouped the 212 domains into issuance batches, and registration timestamps clustered on weekdays inside a single working day. The full infrastructure method is described in our field note, One tag, 212 domains.
3. Followed the money
The sites' deposit pages rotated through 37 payment accounts and 4 cryptocurrency deposit addresses. Merchant descriptors on the payment accounts named two companies. On the public ledger, clustering heuristics tied all 4 deposit addresses to a single consolidation wallet, which forwarded funds to two exchange deposit addresses.
We did not seek, and could not lawfully obtain, exchange customer records. Those were left for law enforcement to request through legal process, and we documented exactly what such a request should ask for.
4. Found the operator
Historical registration records for one of the earliest domains, registered before privacy protection was switched on, showed a registrant email address. The username in that address matched a profile on a freelance developer marketplace advertising "trading platform templates". The profile's portfolio included a screenshot of an administration panel whose layout, color scheme and field labels matched the back end exposed on two of the scam domains. The profile photo matched a public professional profile under a real name. We refer to him here as Subject A.
5. Connected the companies
Corporate registry filings for the two companies in the merchant descriptors listed the same nominee director. Court and property records tied that nominee to Subject A's immediate family. Both companies were incorporated in the same month the first domains were registered.
6. Tried to break it
The red-team reviewer argued the strongest alternative: that Subject A built and sold a reseller kit, and that many unrelated operators were running the sites. If that were true, attributing the whole network to him would be wrong. The alternative failed on the money. Buyers of a kit bring their own payment accounts. Instead, the same 37 accounts and the same consolidation wallet served all 212 domains.
| Line of evidence | Source type | Supports |
|---|---|---|
| Shared analytics container on 212 domains | Web infrastructure | Single operation |
| Certificate batches and registration timing | Certificate and registration history | Single operation |
| Common payment accounts and one consolidation wallet | Payment descriptors, public ledger | Single operation, shared proceeds |
| Registrant email to developer profile to real name | Registration history, public profiles | Operator identity |
| Nominee director tied to the operator's family | Corporate, court and property records | Control of proceeds |
What we found
- High confidence: all 212 domains were part of one operation controlled by Subject A.
- High confidence: proceeds flowed through the 37 payment accounts and a single consolidation wallet.
- Moderate confidence: the nominee director acted on Subject A's behalf.
- Moderate confidence: two associates handled customer support, based on reused support scripts and messaging handles.
The nominee link rested on family records and the timing of incorporation. Both are strong, but they come from overlapping kinds of source. Our standard for high confidence requires at least three independent lines of evidence from distinct source types, so we reported it as moderate and said exactly what further evidence would raise it.
The outcome
Nineteen days after tasking, the bank filed suspicious activity reports supported by our evidence bundle and referred the case to law enforcement in two jurisdictions. Investigators used our findings to obtain exchange and payment records through legal process, and those records confirmed the attribution.
- $41.7M frozen across payment accounts and exchange balances.
- Payments to all 37 accounts blocked at the bank, ending new customer losses from the network.
- Three arrests within four months, including Subject A.
- Affected customers notified and supported through the bank's recovery process.
What made the difference
Takedowns had treated each domain as a separate problem. One reused identifier turned 212 problems into one. But the identifier alone only proved the sites were related. It was the combination with money flows and the registrant trail, each from a different kind of source, that made the attribution hold up under challenge.
And because every item had been hashed at the moment of capture, law enforcement could rely on our evidence bundle without repeating the collection, which is how a referral turned into frozen assets within days rather than months.