# Europol/Eurojust Takedown of Crime-as-a-Service Investment Scam Infrastructure: 100+ Servers Seized, 7 Arrested

> On 3 November 2026 authorities from Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia, supported by Europol and Eurojust, seized over 100 servers and arrested seven suspects in an operation against fraudulent investment platforms run as a crime-as-a-service offering from Cyprus and Israel. Potential victims are located in at least 50 countries.

- **Published:** 2026-11-03T13:56:18Z
- **Last reviewed:** 2026-11-03T13:56:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5155
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5155.png
- **ID:** TL-2026-5155
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

Europol reports that a coordinated action on 3 November 2026, led by the German Itzehoe Public Prosecutor's Office with Europol and Eurojust support, struck the infrastructure behind a large investment fraud scheme. Authorities in Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia took part. Over 100 servers were seized and seven suspects were arrested. The action followed a four-year investigation that began in 2022 and earlier interventions in 2022 and 2025.

Per BleepingComputer's reporting of the Europol release, the scheme operated as 'crime-as-a-service' from Cyprus and Israel. The operators supplied the technical backbone (deceptive advertising, fake trading platforms and related servers) to criminal clients. Investigators identified suspected clients running fraudulent call centres in Albania, Kosovo and North Macedonia. Evidence from earlier operations is reported to have led to seven further suspects, including call-centre managers. The investigation originated from a report by a German couple who could not withdraw invested funds.

Earlier phases of the same investigation are documented by Eurojust, eucrim and Infosecurity Magazine. On 6 September 2022 an action day coordinated by Eurojust, with Itzehoe prosecutors and authorities in Belgium, Germany, Latvia and Finland, saw searches in Belgium and Latvia and two arrests, targeting a network that defrauded over 100 people in 11 countries of several million euros with platforms promising profits for investments that never took place. On 13 May 2025 eight simultaneous searches in Albania, Cyprus and Israel led to one arrest in Cyprus; reporting described call centres posing as brokers, small initial deposits followed by manipulation into larger ones, and fabricated profit graphics, with victims approached by cold calls, online ads or unsolicited messages, and total losses above EUR 3 million.

The reported victim-facing flow for the November 2026 operation has six stages. Deceptive online advertisements steer victims to fraudulent investment platforms promising quick returns from forex, stocks or cryptocurrency. The platforms harvest the victims' personal data, which is sold on to the groups operating call centres. Call-centre agents then pressure victims into larger transfers while the fake account dashboard shows fictitious profits. Finally withdrawals are blocked and contact ceases. Financial losses for the November 2026 operation were not stated in the sources.

No CVEs, malware families, named threat actors or technical indicators (domains, IPs, hashes) were published in the sources reviewed, so none are asserted here. Because no network IOCs were available, BeaconBeagle correlation was not applicable. The IOC list captures entities, infrastructure roles and behavioural patterns that are directly evidenced. The Europol primary page could only be partially retrieved (script-rendered); facts rely on BleepingComputer and mirrors of the Europol release. Separate, unrelated European actions (including an Estonian-led April 2022 Eurojust case) are not part of this operation and are not asserted as linked.

## MITRE ATT&CK

- T1583.004 Server
- T1583.008 Malvertising
- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1684.001 Impersonation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Investment-Scam Infrastructure Web Access (Community-Observed Domains and Workers.dev Clones) — Exploitation / Lure** (`TL-2026-5155-SPL-001`)

Behaviour-first proxy search for users reaching scam domains and Binance/WazirX-lookalike workers.dev hosts that TL_OSINT_Scan ties to the cryptoscam and malvertising clusters adjacent to TL-2026-5155 (Europol/Eurojust investment-fraud takedown, 100+ servers seized). The domain list is community-tier sibling infrastructure (corroboration, not ground truth); the research itself published no domains or IPs. A hit means a user was steered to a fake trading or crypto platform (T1583.008 malvertising lure, T1583.001 scam domain, T1583.006 Cloudflare Workers hosting, T1656 brand impersonation, T1598 information harvesting). Output labels the match type and the referrer so analysts can see whether the visit came from an ad, an email or a search result.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583.001, T1583.004, T1583.006, T1583.008, T1656, T1598
- **Data sources:** zscaler:nss:web, proxy, DeviceNetworkEvents
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
index=proxy sourcetype="zscaler:nss:web" earliest=-24h
| eval threat_id="TL-2026-5155", host=lower(coalesce(dest, url_domain))
| eval ioc_domain=if(match(host, "(^|[.])(nildex[.]com|gambah[.]com|wazirxr[.]com|binanceverify[.]live|binancecheck[.](online|com)|bnbone[.]live|bepxt[.](online|com)|bnbtest20[.]online|bnbet[.]online|bnbvf[.]org)$"), 1, 0), clone_workers=if(match(host, "^binance-com-[a-z0-9]+[.](refers|referrering)[.]workers[.]dev$"), 1, 0), brand_workers=if(match(host, "^(binance|wazirx)[a-z0-9-]*[.]workers[.]dev$"), 1, 0)
| where ioc_domain=1 OR clone_workers=1 OR brand_workers=1
```comment: community-tier sibling infrastructure of TL-2026-5155 (TL_OSINT_Scan cryptoscam/malvertising clusters); workers.dev clones are Cloudflare Workers hosted lures```
| eval match_type=case(ioc_domain=1, "community_ioc_domain", clone_workers=1, "binance_workers_clone", true(), "brand_workers_lookalike")
| stats count AS requests, min(_time) AS first_seen, max(_time) AS last_seen, values(http_method) AS methods, values(url) AS urls, values(referer) AS referrers, values(match_type) AS match_types BY threat_id, user, src, host
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table threat_id first_seen last_seen user src host match_types requests methods urls referrers
````

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType in ("ConnectionSuccess", "ConnectionRequest") and isnotempty(RemoteUrl)
| extend Host = tolower(tostring(parse_url(iff(RemoteUrl has "://", RemoteUrl, strcat("https://", RemoteUrl))).Host))
| extend MatchType = case(
    Host matches regex @"(^|[.])(nildex[.]com|gambah[.]com|wazirxr[.]com|binanceverify[.]live|binancecheck[.](online|com)|bnbone[.]live|bepxt[.](online|com)|bnbtest20[.]online|bnbet[.]online|bnbvf[.]org)$", "community_ioc_domain",
    Host matches regex @"^binance-com-[a-z0-9]+[.](refers|referrering)[.]workers[.]dev$", "binance_workers_clone",
    Host matches regex @"^(binance|wazirx)[a-z0-9-]*[.]workers[.]dev$", "brand_workers_lookalike",
    "")
| where isnotempty(MatchType)
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Processes = make_set(InitiatingProcessFileName), MatchTypes = make_set(MatchType) by DeviceName, InitiatingProcessAccountName, Host, RemoteIP
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessAccountName, Host, RemoteIP, MatchTypes, Connections, Processes
```

### Sigma

```yaml
title: Web Access to Community-Observed Investment/Crypto Scam Infrastructure (TL-2026-5155)
id: 7c1e4a90-3b52-4f1d-8a6e-2d9f0b5c1a01
status: experimental
description: Detects proxy requests to scam domains and Binance/WazirX-lookalike workers.dev hosts that TL_OSINT_Scan associates with the cryptoscam/malvertising clusters related to the TL-2026-5155 investment-fraud crime-as-a-service takedown. Community-tier sightings, not confirmed operation infrastructure.
references:
    - https://www.europol.europa.eu/media-press/newsroom/news/investment-scams-potential-victims-in-least-50-countries-over-100-servers-seized
    - https://www.bleepingcomputer.com/news/security/police-seizes-over-100-servers-in-investment-scam-crackdown/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.resource-development
    - attack.t1583.001
    - attack.t1583.004
    - attack.t1583.006
    - attack.t1583.008
    - attack.defense-evasion
    - attack.t1656
    - attack.reconnaissance
    - attack.t1598
logsource:
    category: proxy
detection:
    selection_exact:
        cs-host:
            - 'nildex.com'
            - 'gambah.com'
            - 'wazirxr.com'
            - 'binanceverify.live'
            - 'binancecheck.online'
            - 'binancecheck.com'
            - 'bnbone.live'
            - 'bepxt.online'
            - 'bepxt.com'
            - 'bnbtest20.online'
            - 'bnbet.online'
            - 'bnbvf.org'
    selection_sub:
        cs-host|endswith:
            - '.nildex.com'
            - '.gambah.com'
            - '.wazirxr.com'
            - '.binanceverify.live'
            - '.binancecheck.online'
            - '.binancecheck.com'
            - '.bnbone.live'
            - '.bepxt.online'
            - '.bepxt.com'
            - '.bnbtest20.online'
            - '.bnbet.online'
            - '.bnbvf.org'
    selection_workers:
        cs-host|re:
            - '^binance-com-[a-z0-9]+[.](refers|referrering)[.]workers[.]dev$'
            - '^(binance|wazirx)[a-z0-9-]*[.]workers[.]dev$'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or threat-intel analysts visiting the domains
    - Sinkhole or URL-detonation tooling resolving the domains
level: medium

```

**Known false positives:**

- Security researchers or analysts browsing the domains
- URL-detonation or sandbox tooling that fetches the domains
- Brand-protection teams testing Binance/WazirX lookalike hosts

**Tuning notes:** Map dest/url_domain/user/src/referer to your proxy CIM fields (swap the sourcetype for pan:url, bluecoat or squid if needed). Refresh the domain list from TL_OSINT_Scan related_community_iocs; remove entries once sinkholed or expired. Exclude security-team and sandbox source ranges. The brand_workers branch is broader than the community list; drop it if it is noisy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Investment-Scam Lure Email with Quick-Return Phrasing — Exploitation / Approach (locked: unlock with TL Creds)
- Sustained Engagement with Investment-Themed Trading Site (Fake Dashboard) — Post-Exploitation (locked: unlock with TL Creds)
- Small First Deposit then 5x Escalation to New Beneficiary — Financial Theft (locked: unlock with TL Creds)
- DNS Lookups for Exchange-Lookalike Scam Domains — Exploitation / Lure (locked: unlock with TL Creds)
- Withdrawal-Blocking / Release-Fee Email Pattern — Post-Exploitation (locked: unlock with TL Creds)
- Investment-Referenced Payment to Operator/Call-Centre Jurisdictions — Monetisation (locked: unlock with TL Creds)
- Personal Data / KYC Submission to Investment-Themed Platform — Post-Exploitation Data Harvest (locked: unlock with TL Creds)
- Escalating Payments to Single Investment Beneficiary — Financial Theft / Monetisation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Investment scams with potential victims in at least 50 countries: over 100 servers seized (Europol)](https://www.europol.europa.eu/media-press/newsroom/news/investment-scams-potential-victims-in-least-50-countries-over-100-servers-seized)
- [Police seizes over 100 servers in investment scam crackdown (BleepingComputer)](https://www.bleepingcomputer.com/news/security/police-seizes-over-100-servers-in-investment-scam-crackdown/)
- [Investment scams with potential victims in at least 50 countries: over 100 servers seized (malware.news mirror)](https://malware.news/t/investment-scams-with-potential-victims-in-at-least-50-countries-over-100-servers-seized/126961)
- [Takedown of Online Investment Fraud with Help by Eurojust and Europol (eucrim, 6 Sept 2022 action)](https://eucrim.eu/news/takedown-of-online-investment-fraud-with-help-by-eurojust-and-europol/)
- [Takedown of online investment fraud responsible for losses of several million euros (Eurojust)](https://www.eurojust.europa.eu/news/takedown-online-investment-fraud-responsible-losses-several-million-euros)
- [European Police Bust EUR 3m Investment Fraud Ring (Infosecurity Magazine, 13 May 2025 action)](https://www.infosecurity-magazine.com/news/european-police-bust-3m-investment/)
- [Gruppe mutmasslicher Anlagebetrueger zerschlagen (CIO.de, 2025 Cyprus/Albania/Israel searches)](https://www.cio.de/article/3985191/gruppe-mutmaslicher-anlagebetrueger-zerschlagen.html)
- [Call centres dismantled and ten arrested in EUR 50 million online fraud case (Europol, related-theme operation)](https://www.europol.europa.eu/media-press/newsroom/news/call-centres-dismantled-and-ten-arrested-in-eur-50-million-online-fraud-case)
- [European police dismantles EUR 50 million crypto investment fraud ring (BleepingComputer, related-theme operation)](https://www.bleepingcomputer.com/news/security/european-police-dismantles-50-million-crypto-investment-fraud-ring/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5155