# Digital Forensics Corporation sextortion 'recovery' scam: FTC alleges $60M taken from victims

> The FTC alleges Digital Forensics Corporation LLC, owner Dmitry Belkin and 11 affiliated companies took at least $60 million from sextortion victims for 'Phase 1' assistance packages that were frequently not delivered. A federal court granted a temporary restraining order halting the business.

- **Published:** 2026-10-15T12:15:36Z
- **Last reviewed:** 2026-10-15T12:15:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3615
- **ID:** TL-2026-3615
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Actor:** Dmitry Belkin
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On October 13, 2026 the U.S. Federal Trade Commission filed FTC v. Digital Forensics Corporation, LLC, et al. in the U.S. District Court for the Northern District of Ohio (case 1:26-cv-02615 as reported by a third-party tracker) against Digital Forensics Corporation LLC (DFC), its CEO/owner Dmitry Belkin and 11 other companies, many listing 4400 Renaissance Parkway, Warrensville Heights, Ohio. The Commission voted 2-0 to authorize the complaint and the court granted a temporary restraining order halting the defendants' activities pending further proceedings. The conduct is alleged to have run from February 2023 through July 2026 and to have netted at least $60 million.

Per the FTC, the defendants advertised on search engines, video platforms and social media (Google, YouTube, X and others) and used fear-based telemarketing to reach consumers in crisis, including military members and married individuals. Victims were sold 'Phase 1' packages priced from $1,499 to $20,000 that were promised to stop the attack, pinpoint the sextortionist's location through a 'tracking campaign', deliver a detailed investigative report, notify law enforcement and send a cease-and-desist letter. The FTC alleges that in numerous instances none of this was delivered: staff routinely only changed victim account settings to block the sextortionist (something victims can do themselves), fabricated chat transcripts and investigative information, and reused pre-saved coordinates, typically for Nigeria and the Philippines, to present as the perpetrator's location. Victims were also reportedly discouraged from blocking blackmailers, contrary to law-enforcement and expert advice, and were pressured into additional 'Phase 2' monitoring/reporting services costing thousands more. Installment financing with interest up to 18% was reportedly offered and refunds refused citing contract policies.

The FTC further alleges review fraud: India-based employees wrote fake reviews, positive reviews were purchased from Uber drivers who never used the service, customers were coerced into posting positive reviews before receiving services, legitimate negative reviews were suppressed, and complaints were reportedly directed to fake BBB websites. Alleged violations include the FTC Act, Telemarketing Sales Rule, Reviews and Testimonials Rule and Gramm-Leach-Bliley Act. This is a fraud-ecosystem item with no CVE, malware or technical IOCs; it is relevant to defenders as victim-targeting abuse context (secondary exploitation of sextortion victims). Severity is an analyst judgment, not source-stated. Allegations are unproven claims in a civil complaint.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.001 Domains
- T1585 Establish Accounts
- T1684.001 Impersonation
- T1657 Financial Theft

## Sources

- [Sextortion 'help' firm took $60 million from victims, FTC alleges (Malwarebytes)](https://www.malwarebytes.com/blog/news/2026/10/sextortion-help-firm-took-60-million-from-victims-ftc-alleges)
- [FTC Sues Operator of Sextortion Relief Scheme for Misleading Consumers into Believing it Would Identify Criminals and End Sextortion Attacks](https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-sues-operator-sextortion-relief-scheme-misleading-consumers-believing-it-would-identify)
- [FTC complaint: FTC v. Digital Forensics Corporation, LLC, et al.](https://www.ftc.gov/system/files/ftc_gov/pdf/digitalforensicscomplaint.pdf)
- [FTC: Company netted at least $60 million charging sextortion victims for help it didn't provide (The Record)](https://therecord.media/sextortion-assistance-company-alleged-fraud-ftc-complaint)
- [Digital Forensics accused by US FTC of misleading 'sextortion' victims (MLex)](https://www.mlex.com/mlex/articles/2537302)
- [FTC halts Ohio firm accused of scamming sextortion victims](https://www.yahoo.com/news/us/articles/ftc-halts-ohio-firm-accused-210433699.html)
- [FTC secures restraining order against Digital Forensics LLC (dig.watch)](https://dig.watch/updates/ftc-secures-order-against-digital-forensics-corp)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3615