This article has been indexed from CircleID: Cybercrime
Note: A special thanks to Ed Gibbs, WhoisXML API’s Advanced Threat Researcher & Technical Account Manager, for his help compiling the domain and subdomain files used in this post.
Cryptocurrencies keep making waves in the online community, making them prime vehicles of threat actors in scam, phishing, and other malicious campaigns. Fraudsters, for one, have stolen millions of dollars worth of cryptocurrencies from investors through websites that promise rewards, giveaways, and earning opportunities.
Does it mean it’s time to monitor crypto-related Internet properties that could end up being used in a scam?
The WhoisXML API security research team did so, and identified more than 31,000 crypto-related domains and subdomains and analyzed them based on the following angles of research:
- Screenshots: What do the domains look like?
- Registrant email addresses: Who owns the domains?
- Registrar details: Who manages the domains?
How the Data Was Gathered
We searched WHOIS and subdomains databases for domains and subdomains that contain the text strings “bitcoin,” “doge,” and “cardano.” These cryptocurrencies were chosen because they were among the most newsworthy ones.
Bitcoin, for one, is almost synonymous with cryptocurrency. On the other hand, Dogecoin recently made headlines after famous personalities (including Elon Musk) expressed support for it. Cardano has also been in the news after becoming fully decentralized in April 2021.
A total of 31,555 domains and subdomains were found broken down into:
| Search Term | Number of Domains and Subdomains Containing the Search Term |
|---|---|
| “bitcoin” | 20,121 |
| “doge” | 10,757 |
| “cardano” | 677 |
Screenshot Analysis
Website Screenshot API allowed us to do a bulk screenshot lookup for the domains and subdomains. Some domains resolved to pages that indicate the websites are still under construction. As expected, several domains were parked, some of which are for sale for over US$1,000 each.
