How We Used Osentix to Track Down the Masterminds Behind a Fraud Network
At Osentix, we work daily to shed light on the shadows of the digital world. Our software is a powerful tool for Open Source Intelligence (OSINT) analysis, enabling us to identify even sensitive data, find vulnerabilities in IT infrastructures, and ultimately identify perpetrators.
Recently, reports of a sophisticated investment scam have been increasing. Victims signed up with alleged brokers on the internet and were contacted by a "consultant" who promised high profits. An initial investment of just 250 euros was supposed to grant access to a trading platform. There, the victims saw their money supposedly growing, while the consultant repeatedly urged them to make further investments. What they didn't know: the profits were fake, the money was never really invested. This is a so-called trading scam, also known as "Pig Butchering" in expert circles. These fraudulent brokers are unscrupulous and drive their victims to ever higher investments until they are financially completely drained. When the victims then try to withdraw their money, "fees" or other pretexts are suddenly invented to prevent the payout.
Our Analysis with Osentix
We immediately analyzed the fraudulent website with our software. Osentix automatically displayed all vulnerabilities and the underlying IT infrastructure in a clear graph. It quickly became clear that the websites were hosted on servers of the company W1n Ltd.
During a more in-depth analysis of the internal files, Osentix came across a conspicuous CSS file named intlTellnput. Our software immediately showed us which other websites also used this file. Surprisingly, there were over 800 websites! All of them were almost identical copies of the original fraudulent site, only logos and names were different. It became clear: the perpetrators were operating a gigantic network of fraudulent websites.
But the perpetrators made a crucial mistake. They also used the same CSS file on another website – one that actually revealed information about themselves. This website turned out to be an investment company in Dubai, supposedly investing in real estate. The CEO staged himself on Instagram as a successful entrepreneur with almost 52,000 followers, whom he impressed with pictures in expensive brand clothing, luxury cars, and villas. A LinkedIn profile of the company could also be found. Thanks to this mistake, the exact person could be identified and it was even possible to trace how the stolen money was laundered.
The Next Mistake: Open Doors
The fraudulent websites were also examined for open ports and publicly accessible files. We came across a .env file. A .env file (environment file) is a simple text file that stores environment variables for a software application. These variables often contain sensitive information such as database access data, API keys, or passwords that should not be stored directly in the code to increase security. If this file is publicly accessible, it is a serious security leak.
The found .env file contained all the access data to the perpetrators' mailbox and database. With this information, we were able to identify all the victims and trace the entire email traffic of the fraudsters.
Another serious mistake: the accused had also stored their OpenAI_API Key in the .env file. An OpenAI_API Key is an access key that enables the use of OpenAI's artificial intelligence (AI), for example for language models such as GPT. This key is highly sensitive as it provides access to AI services and potentially to the associated accounts of the perpetrators. This key can reveal further connections and usage patterns of the perpetrators, which is invaluable for the investigation.
Conclusion
Thanks to Osentix, we were able to uncover the entire infrastructure of the perpetrators in just 10 minutes. Over 800 fraudulent websites in their network were identified. The vulnerabilities found led directly to the identity of the perpetrators. Not only that: we were able to locate all the victims and gained access to the database and email addresses of the fraudsters.
This case impressively shows that Osentix is able to track down the identity of perpetrators in the shortest possible time. With just one click, the results can be exported as a report that is admissible in court. This revolutionizes OSINT research and makes it more effective than ever.