Uncovering a Wider Scam Network Through Website Forensic Analysis
Websites involved in scams and online fraud rarely operate in complete isolation. Even where the people behind a website attempt to conceal their identity, technical infrastructure, historical records and connections with other online services can provide valuable investigative leads.
Disclaimer: This case study is based on a genuine Cybertrace investigation. However, names, domains and identifying details have been changed to protect confidential investigative information and sources.
In a recent Cybertrace investigation, our investigators examined a payment-related website suspected of having connections to a wider international investment fraud network.
The investigation demonstrates how website forensic analysis can go beyond identifying who registered a domain. By examining historical infrastructure, associated domains, subdomains, website interfaces and other technical indicators, investigators can sometimes uncover relationships that are not apparent from the public-facing website.
The Investigation
Cybertrace had previously developed intelligence concerning payment-processing infrastructure associated with international investment fraud operations.
The intelligence had been collected through a combination of technical analysis, open-source intelligence (OSINT) and human intelligence (informant) obtained during investigations into overseas scam operations.
During further analysis, Cybertrace identified a server environment being used by numerous high-risk payment-related websites and services.
However, the fact that different websites were using the same IP address was not considered sufficient evidence that they were owned or operated by the same people. The IP address was associated with a Content Delivery Network, or CDN, meaning that unrelated websites could potentially share the same infrastructure. This distinction was important.
Website forensic investigations often involve identifying technical relationships, but investigators must also determine whether those relationships are genuinely significant or simply the result of commonly used hosting, security or technology providers. This is where expertise is crucial to avoid falsely linking entities, or, to address information and evidence gaps that would otherwise remain unsolved.
Looking Beyond the IP Address
Cybertrace therefore examined additional technical indicators.
Historical analysis identified numerous payment-related subdomains associated with the infrastructure. Further investigation found similarities between several of the websites, including similarly structured merchant, administration, account and payment subdomains.
The websites also displayed substantially similar page templates and interfaces.
Taken together, these indicators suggested that a number of otherwise separately branded services may have been connected through a common underlying platform, backend environment or service provider. Historical records were particularly useful.
Some websites had subsequently moved to different hosting environments, meaning their current technical configuration no longer revealed the earlier relationship. Historical infrastructure analysis allowed Cybertrace to identify connections that would have been difficult to detect by examining the websites only as they existed at the time of the investigation.
Identifying a Wider Website Network
The investigation also identified a much broader network of related domains associated with the website under investigation.
Several domains using variations of the same brand name had previously redirected to, or otherwise been associated with, the primary website. This indicated that the website formed part of a broader online ecosystem rather than operating as an isolated domain. This type of analysis can be particularly valuable in scam investigations.
Scam networks frequently operate multiple websites, brands and domain names. Websites may be replaced, redirected or abandoned as complaints increase or regulatory attention develops. Looking at a single website can therefore provide only part of the picture.
Historical domain and infrastructure research can reveal earlier websites, related services and technical relationships that remain relevant even after the public-facing websites have changed.
Combining Technical Evidence With Intelligence
The technical findings were then compared with intelligence Cybertrace had independently obtained from sources operating within overseas scam call centres.
Those sources identified a website technically connected to the infrastructure under investigation as being used within scam investment operations and associated payment-processing arrangements. This provided an important additional layer of evidence.
Technical similarities can demonstrate that websites are connected in some way, but they do not necessarily explain how those websites are being used. In this investigation, independent intelligence concerning the operational use of part of the infrastructure strengthened the significance of the technical findings.
The convergence of different evidence sources ultimately provided a stronger basis for assessing the relationship between the investigated website and the wider payment-processing network than any single technical indicator could have provided on its own.
What the Investigation Established
Cybertrace identified significant circumstantial evidence connecting the investigated website with a broader payment-processing network associated with international investment fraud.
The investigation identified overlapping infrastructure, similarities between merchant and administration systems, related domain networks and substantially similar website interfaces.
It also identified connections with technology used by other payment-processing operations associated with online scam activity.
Importantly, Cybertrace did not conclude that shared infrastructure proved common ownership.
The available evidence supported a technical connection between the website and the broader network, but common ownership or operational control had not been confirmed. Further information from relevant service providers would have been required to establish the identities of the entities controlling particular infrastructure.
That distinction is important in any forensic investigation.
The purpose of website forensics is not simply to find technical similarities and declare two websites connected. Investigators must consider the strength of each indicator, alternative explanations and whether independent evidence supports the same conclusion.
What This Case Demonstrates
This investigation illustrates how website forensic analysis can uncover information that may not be visible through a conventional search of the website itself.
By combining current and historical infrastructure analysis, domain research, subdomain identification, technical comparisons, OSINT and other investigative intelligence, it may be possible to uncover wider networks of related websites and services.
These findings can help identify new investigative leads, establish relationships between online entities and determine where further information may be available from hosting companies, technology providers, registrars or other third parties.
Website forensic investigations do not always result in the identification of the individual behind a website. However, where several independent sources of evidence converge, they can significantly improve our understanding of how a website operates and who or what may be connected to it.
