This investigation started with a scammy Roblox page that was still live when this was published. Follow the redirects far enough, and it leads to a hosting provider whose address range was indexed serving malware built to hijack home routers and security cameras into a botnet.
Where this started
I ran into this scam page when I was researching some shady looking YouTube channels running redirects to possible malicious sites. Out of roughly 200 checked, I found 4 running their own link-redirect instead of renting one from a service like Bitly. That's legal. But smells fishy as hell.
Open it and you land behind a real scammy offerwall: finish a survey or a download, the site owner gets paid per completion, and the visitor gets nothing. A security research group had already logged this same domain running a completely different scam months earlier, a fake Apple ID login page, under the same registration. As usual practice, they reskinned it and continued uninterrupted.
This is maintained, reused infrastructure, not a page thrown up once and abandoned. Tracing the redirect is where this stopped being a story about one scammy giveaway page and gets much bigger.
Where it led
The page's host buys its internet connectivity from providers that include two networks on Spamhaus's list of networks to drop traffic from. Routing data ties that backbone's address space to router-and-camera botnet malware, indexed inside the same address range as other scam pages, all within that backbone's own controlled territory. While that doesn't prove the backbone's operators run the malware themselves, it proves bad actors feel confident hosting here, assuming they won't get caught or shut down by law enforcement.
What a scan of the cluster found
A full scan of everything that has touched this hosting cluster since December 2023 found:
- 1,589 domains total
- 196 of them still live at the time of the scan
- neighbors on the backbone include a large Turkish illegal-gambling redirect network with real reported victim losses, a fake Adobe update page built to deliver malware rather than steal a password, a professionally built fake investment firm (pig butchering anyone?), and a run of pre-launch meme-coin hype sites
The paper trail
The ownership trail is where this got interesting in a different way. The host is registered in the Seychelles and the address is shared with at least fifteen other unrelated companies, clearly shell-mill traffic.
Of the companies identified, one is used by only five organizations in the entire global internet registry. Together, they tie this stack of companies to entities in Hong Kong, Amsterdam, Bulgaria and the UK. So this is clearly a multinational effort.
This structure shows very clearly that threat actors are organized, have a multi level org structure and are adaptive.
If you ever shut down a scam page and felt really good about yourself, this research should make you doubt that.
More work: the jobs that never reached the sheet · the analyst that refuses to guess