Skip to navigation

Threat reportThreat IntelligenceTL-2026-5155

Europol/Eurojust Takedown of Crime-as-a-Service Investment Scam Infrastructure: 100+ Servers Seized, 7 Arrested

mediumMONITORING

On 3 November 2026 authorities from Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia, supported by Europol and Eurojust, seized over 100 servers and arrested seven suspects in an operation against fraudulent investment platforms run as a crime-as-a-service offering from Cyprus and Israel. First disclosed .

Key facts for Europol investment scam takedown

IdentifiersTL-2026-5155
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsRetail investors and consumers Online investment platforms (forex, stocks, cryptocurrency offerings)
MITRE ATT&CK techniquesT1583.004 Server, T1583.008 Malvertising, T1589 Gather Victim Identity Information, T1598 Phishing for Information, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorsconsumers, retail investors, financial services, cryptocurrency
Target regionsEurope, Global
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for Europol investment scam takedown

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5155 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Investment-Scam Infrastructure Web Access (Community-Observed Domains and Workers.dev Clones) — Exploitation / Lure

Behaviour-first proxy search for users reaching scam domains and Binance/WazirX-lookalike workers.dev hosts that TL_OSINT_Scan ties to the cryptoscam and malvertising clusters adjacent to TL-2026-5155 (Europol/Eurojust investment-fraud takedown, 100+ servers seized). The domain list is community-tier sibling infrastructure (corroboration, not ground truth); the research itself published no domains or IPs. A hit means a user was steered to a fake trading or crypto platform (T1583.008 malvertising lure, T1583.001 scam domain, T1583.006 Cloudflare Workers hosting, T1656 brand impersonation, T1598 information harvesting). Output labels the match type and the referrer so analysts can see whether the visit came from an ad, an email or a search result.

Splunk SPL

index=proxy sourcetype="zscaler:nss:web" earliest=-24h
| eval threat_id="TL-2026-5155", host=lower(coalesce(dest, url_domain))
| eval ioc_domain=if(match(host, "(^|[.])(nildex[.]com|gambah[.]com|wazirxr[.]com|binanceverify[.]live|binancecheck[.](online|com)|bnbone[.]live|bepxt[.](online|com)|bnbtest20[.]online|bnbet[.]online|bnbvf[.]org)$"), 1, 0), clone_workers=if(match(host, "^binance-com-[a-z0-9]+[.](refers|referrering)[.]workers[.]dev$"), 1, 0), brand_workers=if(match(host, "^(binance|wazirx)[a-z0-9-]*[.]workers[.]dev$"), 1, 0)
| where ioc_domain=1 OR clone_workers=1 OR brand_workers=1
```comment: community-tier sibling infrastructure of TL-2026-5155 (TL_OSINT_Scan cryptoscam/malvertising clusters); workers.dev clones are Cloudflare Workers hosted lures```
| eval match_type=case(ioc_domain=1, "community_ioc_domain", clone_workers=1, "binance_workers_clone", true(), "brand_workers_lookalike")
| stats count AS requests, min(_time) AS first_seen, max(_time) AS last_seen, values(http_method) AS methods, values(url) AS urls, values(referer) AS referrers, values(match_type) AS match_types BY threat_id, user, src, host
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table threat_id first_seen last_seen user src host match_types requests methods urls referrers

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType in ("ConnectionSuccess", "ConnectionRequest") and isnotempty(RemoteUrl)
| extend Host = tolower(tostring(parse_url(iff(RemoteUrl has "://", RemoteUrl, strcat("https://", RemoteUrl))).Host))
| extend MatchType = case(
    Host matches regex @"(^|[.])(nildex[.]com|gambah[.]com|wazirxr[.]com|binanceverify[.]live|binancecheck[.](online|com)|bnbone[.]live|bepxt[.](online|com)|bnbtest20[.]online|bnbet[.]online|bnbvf[.]org)$", "community_ioc_domain",
    Host matches regex @"^binance-com-[a-z0-9]+[.](refers|referrering)[.]workers[.]dev$", "binance_workers_clone",
    Host matches regex @"^(binance|wazirx)[a-z0-9-]*[.]workers[.]dev$", "brand_workers_lookalike",
    "")
| where isnotempty(MatchType)
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName), MatchTypes = make_set(MatchType) by DeviceName, InitiatingProcessAccountName, Host, RemoteIP
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessAccountName, Host, RemoteIP, MatchTypes, Connections, Processes

Sigma

title: Web Access to Community-Observed Investment/Crypto Scam Infrastructure (TL-2026-5155)
id: 7c1e4a90-3b52-4f1d-8a6e-2d9f0b5c1a01
status: experimental
description: Detects proxy requests to scam domains and Binance/WazirX-lookalike workers.dev hosts that TL_OSINT_Scan associates with the cryptoscam/malvertising clusters related to the TL-2026-5155 investment-fraud crime-as-a-service takedown. Community-tier sightings, not confirmed operation infrastructure.
references:
    - https://www.europol.europa.eu/media-press/newsroom/news/investment-scams-potential-victims-in-least-50-countries-over-100-servers-seized
    - https://www.bleepingcomputer.com/news/security/police-seizes-over-100-servers-in-investment-scam-crackdown/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.resource-development
    - attack.t1583.001
    - attack.t1583.004
    - attack.t1583.006
    - attack.t1583.008
    - attack.defense-evasion
    - attack.t1656
    - attack.reconnaissance
    - attack.t1598
logsource:
    category: proxy
detection:
    selection_exact:
        cs-host:
            - 'nildex.com'
            - 'gambah.com'
            - 'wazirxr.com'
            - 'binanceverify.live'
            - 'binancecheck.online'
            - 'binancecheck.com'
            - 'bnbone.live'
            - 'bepxt.online'
            - 'bepxt.com'
            - 'bnbtest20.online'
            - 'bnbet.online'
            - 'bnbvf.org'
    selection_sub:
        cs-host|endswith:
            - '.nildex.com'
            - '.gambah.com'
            - '.wazirxr.com'
            - '.binanceverify.live'
            - '.binancecheck.online'
            - '.binancecheck.com'
            - '.bnbone.live'
            - '.bepxt.online'
            - '.bepxt.com'
            - '.bnbtest20.online'
            - '.bnbet.online'
            - '.bnbvf.org'
    selection_workers:
        cs-host|re:
            - '^binance-com-[a-z0-9]+[.](refers|referrering)[.]workers[.]dev$'
            - '^(binance|wazirx)[a-z0-9-]*[.]workers[.]dev$'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or threat-intel analysts visiting the domains
    - Sinkhole or URL-detonation tooling resolving the domains
level: medium

Known false positives:

  • Security researchers or analysts browsing the domains
  • URL-detonation or sandbox tooling that fetches the domains
  • Brand-protection teams testing Binance/WazirX lookalike hosts

Tuning notes: Map dest/url_domain/user/src/referer to your proxy CIM fields (swap the sourcetype for pan:url, bluecoat or squid if needed). Refresh the domain list from TL_OSINT_Scan related_community_iocs; remove entries once sinkholed or expired. Exclude security-team and sandbox source ranges. The brand_workers branch is broader than the community list; drop it if it is noisy.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Investment-Scam Lure Email with Quick-Return Phrasing — Exploitation / Approach · unlock with TL Creds
  • Sustained Engagement with Investment-Themed Trading Site (Fake Dashboard) — Post-Exploitation · unlock with TL Creds
  • Small First Deposit then 5x Escalation to New Beneficiary — Financial Theft · unlock with TL Creds
  • DNS Lookups for Exchange-Lookalike Scam Domains — Exploitation / Lure · unlock with TL Creds
  • Withdrawal-Blocking / Release-Fee Email Pattern — Post-Exploitation · unlock with TL Creds
  • Investment-Referenced Payment to Operator/Call-Centre Jurisdictions — Monetisation · unlock with TL Creds
  • Personal Data / KYC Submission to Investment-Themed Platform — Post-Exploitation Data Harvest · unlock with TL Creds
  • Escalating Payments to Single Investment Beneficiary — Financial Theft / Monetisation · unlock with TL Creds

Indicators of compromise for Europol investment scam takedown

As of 2026-11-03, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5155.

8 indicators of compromise · unlock with TL Creds. Compare plans

How Europol investment scam takedown works

Potential victims are located in at least 50 countries.

Europol reports that a coordinated action on 3 November 2026, led by the German Itzehoe Public Prosecutor's Office with Europol and Eurojust support, struck the infrastructure behind a large investment fraud scheme. Authorities in Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia took part. Over 100 servers were seized and seven suspects were arrested. The action followed a four-year investigation that began in 2022 and earlier interventions in 2022 and 2025.

Per BleepingComputer's reporting of the Europol release, the scheme operated as 'crime-as-a-service' from Cyprus and Israel. The operators supplied the technical backbone (deceptive advertising, fake trading platforms and related servers) to criminal clients. Investigators identified suspected clients running fraudulent call centres in Albania, Kosovo and North Macedonia. Evidence from earlier operations is reported to have led to seven further suspects, including call-centre managers. The investigation originated from a report by a German couple who could not withdraw invested funds.

Earlier phases of the same investigation are documented by Eurojust, eucrim and Infosecurity Magazine. On 6 September 2022 an action day coordinated by Eurojust, with Itzehoe prosecutors and authorities in Belgium, Germany, Latvia and Finland, saw searches in Belgium and Latvia and two arrests, targeting a network that defrauded over 100 people in 11 countries of several million euros with platforms promising profits for investments that never took place. On 13 May 2025 eight simultaneous searches in Albania, Cyprus and Israel led to one arrest in Cyprus; reporting described call centres posing as brokers, small initial deposits followed by manipulation into larger ones, and fabricated profit graphics, with victims approached by cold calls, online ads or unsolicited messages, and total losses above EUR 3 million.

The reported victim-facing flow for the November 2026 operation has six stages. Deceptive online advertisements steer victims to fraudulent investment platforms promising quick returns from forex, stocks or cryptocurrency. The platforms harvest the victims' personal data, which is sold on to the groups operating call centres. Call-centre agents then pressure victims into larger transfers while the fake account dashboard shows fictitious profits. Finally withdrawals are blocked and contact ceases. Financial losses for the November 2026 operation were not stated in the sources.

No CVEs, malware families, named threat actors or technical indicators (domains, IPs, hashes) were published in the sources reviewed, so none are asserted here. Because no network IOCs were available, BeaconBeagle correlation was not applicable. The IOC list captures entities, infrastructure roles and behavioural patterns that are directly evidenced. The Europol primary page could only be partially retrieved (script-rendered); facts rely on BleepingComputer and mirrors of the Europol release. Separate, unrelated European actions (including an Estonian-led April 2022 Eurojust case) are not part of this operation and are not asserted as linked.

MITRE ATT&CK techniques by tactic:

Resource Development

T1583.004 Server; T1583.008 Malvertising

Reconnaissance

T1589 Gather Victim Identity Information; T1598 Phishing for Information

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation for Europol investment scam takedown

Immediate actions

  • Warn customers and staff about unsolicited investment offers promising quick returns via forex, stocks or crypto, especially those reached through online adverts, cold calls or unsolicited messages
  • Flag and review outbound payments to newly onboarded 'trading platform' beneficiaries that match victim-reported patterns such as repeated escalating transfers followed by blocked withdrawals
  • Report suspected fraudulent platforms and payments to national police and the relevant financial regulator

Workarounds

  • Verify any investment firm against the national regulator's authorised-firm register before transferring funds
  • Do not share identity documents or personal data with unsolicited investment platforms

Longer-term hardening

  • Add investment-fraud scenarios (fake profit dashboards, withdrawal blocking, call-centre pressure) to security-awareness and customer-education programs
  • Tune fraud-monitoring models for escalating-transfer and cryptocurrency on-ramp behaviour consistent with investment scams
  • Establish takedown and reporting channels with ad platforms for deceptive investment advertisements

Affected and fixed versions

  • Retail investors and consumers — Online investment platforms (forex, stocks, cryptocurrency offerings)
    Vulnerable versions: Potential victims in at least 50 countries

Timeline of Europol investment scam takedown

  • Investigation by German Itzehoe prosecutors begins after a German couple reports being unable to withdraw funds invested on a fraudulent platform (year per BleepingComputer's 'four-year investigation'; exact date not stated).
  • Eurojust-coordinated action day with Europol support: 12 locations searched in Belgium and Latvia and two suspects arrested; Itzehoe prosecutors with authorities in Belgium, Germany, Latvia and Finland. Network defrauded 100+ victims in 11 countries of several million euros.
  • Eight simultaneous searches in Albania, Cyprus and Israel, with one arrest in Cyprus; German-led, supported by locked-ioc-8 with UK participation. Reported losses over EUR 3 million from at least 100 victims; call centres posed as brokers and used fake profit graphics.
  • Infosecurity Magazine and CIO.de publicly report the May 2025 searches in Cyprus, Albania and Israel, stating Europol considered the network dismantled while further members might remain at large.
  • Separate, related-in-theme Europol action: call centres dismantled and ten arrested in a EUR 50 million online fraud case (context only; not stated to be linked).
  • Europol publishes its press release and BleepingComputer reports the crackdown: crime-as-a-service model run from Cyprus and Israel, call centres in Albania, Kosovo and North Macedonia, potential victims in at least 50 countries.
  • Coordinated action by authorities in Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia, supported by locked-ioc-8 and led by the Itzehoe Public Prosecutor's Office: over 100 servers seized and seven suspects arrested after a four-year investigation.

Sources cited for Europol investment scam takedown

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats