The Rise of Disinformation-as-a-Service (DaaS)
Modern web scams are no longer isolated operations run by solo actors. Cybercriminals operate within highly specialized, coordinated ecosystems where Disinformation-as-a-Service (DaaS) mirrors the established dynamics of Malware-as-a-Service (MaaS).
Investigators frequently discover networks of over 100 distinct web domains replicating identical content structures, including headlines, images, and fabricated interviews. Replicating infrastructure in this manner serves as a clear fingerprint of automated strategy and centralized authorship. By reusing structural designs and technical assets, threat actors minimize setup effort while obscuring direct traceability.
How Scammers Automate Fake Web Infrastructure
Deploying hundreds of deceptive websites has become streamlined, highly automated, and inexpensive:
- Automated Domain Registration and Cheap TLDs: Domain registration and website hosting are easily automated through registrars like GoDaddy and Content Delivery Networks (CDNs) like Cloudflare. Scammers deploy diverse top-level domains (TLDs) such as
.info,.pro,.buzz,.org,.world, and.com. TLD choices align with content based on registration pricing, with AI tools increasingly used to select low-cost domains to register. - Expired Domain Hunting: Domain hunters actively monitor the expiration times of high-prestige domains. When a reputable domain expires, threat actors purchase it to exploit its residual brand trust for phishing and disinformation campaigns.
- Generative AI Deployment: AI tools make creating and deploying complete websites from scratch, such as hosting site setups via Claude on GitHub Pages, a trivial task.
- Short-Lived Burner Domains: Campaign operators regularly use short-lived domains that appear, exploit victims, and quickly vanish to evade detection. While passive DNS services like Censys maintain historical records to assist investigators, tracking these “create, exploit, abandon” lifecycles remains a major hurdle.
Digital Marketing Misuse: Camouflaging Fraud in Plain Sight
A key element of modern automated scams is the integration of digital marketing tactics with financial fraud:
1. Paid Social Media Ads
Threat campaigns routinely rely on paid advertisements and promoted posts across social networks like Facebook and Instagram to drive user traffic to fraudulent articles and platforms.
2. UTM Parameter Manipulation
Threat actors append digital marketing tracking parameters, such as utm_source, utm_medium=paid, and utm_campaign, to malicious links. In some instances, parameters include references to legitimate news agencies like Europa Press. While functionally accessory, these parameters create a false veneer of legitimacy that deceives users into trusting the link. Analysts recommend always testing suspicious URLs on scanners like VirusTotal before clicking.
How Safehorizon’s DRACO Could Be Used in Cyber Investigations
To counter the industrial scaling of web scams, researchers within the Safehorizon project are developing DRACO (Digital Reconnaissance & Analysis Correlator). Beyond simple domain inspection, DRACO is built to identify hidden technical infrastructure and offers several powerful applications for cyber defense:
- Training AI Models for Automated Fraud Detection: DRACO identifies technical infrastructure configurations behind web domains to feed structured data into machine learning models, improving the real-time detection of fraudulent portals.
- Mapping Website Request Flows: Developed in response to the high risk posed by social media ads, DRACO analyzes website request maps to expose how digital marketing parameters and ad networks funnel users toward malicious sites.
- Verifying Digital Certificates: Legitimate investment platforms require rigorous identity checks, whereas fraudulent sites rely on easily obtainable, free Domain Validated (DV) SSL certificates. DRACO can be used to check digital certificate configurations across networks to flag illegitimate portals.
- Tracking Historical DNS Lifecycles: Subject to future project funding, DRACO is planned to store historical DNS records, allowing analysts to trace short-lived burner domains across their full lifecycle from registration to abandonment.
- Correlating Shared Infrastructure Assets: By building on research into shared SSH keys and server setup patterns, DRACO enables investigators to correlate disparate domains under unified threat actors, bypassing surface-level domain name masking.
Spotting Fake Investment Platforms: A Verification Checklist
Fake investment portals are created under multiple brand names to prevent direct attribution and steal user credentials for subsequent social engineering attacks. Grounded in OSINT methodologies, here is a practical verification checklist:
- Verify Domain Creation Age: Check when the domain was registered using WHOIS queries or specialized lookup tools like crt.sh, ViewDNS (
viewdns.info), or SecurityTrails (securitytrails.com). Recently registered domains with little operational history are a major red flag. - Consult Official Regulatory Registries: Check whether the platform is listed in official watchdog databases, such as Spain’s CNMV or international registers like FINRA BrokerCheck. Unrealistic promises of high yields from unknown entities should immediately raise suspicion.
- Inspect Digital SSL Certificates: Verify the site’s SSL certificate by clicking the browser padlock icon or using online SSL checkers. Reliance on free Domain Validated (DV) certificates without identity verification indicates potential risk.
- Examine Contact Details: Be wary of platforms listing generic email addresses, such as
@gmail.comor@yahoo.com, instead of domain-matched corporate emails. - Cross-Search for Fraud Keywords: Search the web using the domain name combined with terms like
"scam","estafa", or"fraud"to see if other users or fact-checkers have reported issues.
Conclusion
Automated scam networks thrive on speed, structural repetition, and user confusion. However, their reliance on shared technical setups is also their greatest weakness.
Tools like Safehorizon’s DRACO provide threat intelligence teams with the correlation capabilities needed to look past domain names, trace underlying infrastructure, and dismantle automated fraud networks at scale.
References
- Europol — Online Fraud Schemes: A Web of Deceit
https://www.europol.europa.eu/publication-events/main-reports/spotlight-report-online-fraud-iocta-2023 - Europol — Network Selling Fake Financial Services Online Taken Down
https://www.europol.europa.eu/media-press/newsroom/news/network-selling-fake-financial-services-online-taken-down - ICANN — INFERMAL: Inferential Analysis of Maliciously Registered Domains
https://www.icann.org/resources/pages/inferential-analysis-maliciously-registered-domains-infermal-2024-12-03-en - ICANN — INFERMAL Final Report
https://www.icann.org/en/system/files/files/inferential-analysis-maliciously-registered-domains-08nov24-en.pdf - CNMV — Decálogo para evitar chiringuitos financieros
https://www.cnmv.es/portal/inversor/decalogo-chiringuitos - CNMV — Authorised Entities
https://www.cnmv.es/portal/inversor/entidades-autorizadas - FINRA — BrokerCheck
https://brokercheck.finra.org/ - Let’s Encrypt — Certificate Policy
https://letsencrypt.org/documents/isrg-cps-v2.9/ - Machine Learning-Based Domain Risk Assessment for Cybersecurity Monitoring in Industrial Systems
https://www.mdpi.com/2227-9717/14/17/2835 - Malicious Registrations in the Domain Name Market: An Analysis of 2025 gTLD Registrations and Cybercriminal Demand
https://interisle.net/insights/cybercriminaldomaindemand