URL of Scam: byokcrypto.co

Type of Scam: Investment
Calculated Amount Loss: $44,797.00

Victim Description:
The victim had questions regarding a cryptocurrency platform they were involved with, specifically byokcrypto.co. The platform led the victim to make substantial investments, but once the funds were deposited, they were unable to withdraw any profits or principal. The platform likely used deceptive tactics, offering promises of high returns but ultimately seizing the victim’s funds. The victim reported a total loss of $44,797.00 and has not been able to access the deposited funds since making the transaction.

Wallet Addresses:

0xa5e6bb93371e2c8FB3BFb68Cb2B0996e7792D93a

Open-Source Intelligence Analysis: Preliminary Findings on Fraudulent Activities Associated with byokcrypto.co

Current Website:
byokcrypto.co is an investment platform that falsely claims to be involved in cryptocurrency trading. The victim was led to invest substantial amounts in the platform, but after sending the funds, they were unable to withdraw them. The site presents itself as a legitimate crypto trading platform but is, in fact, a scam designed to steal users’ funds. The platform likely used persuasive marketing tactics to lure in victims by promising lucrative returns, only to trap them once the funds were deposited.

Domain and Hosting Information:

Registrar: Spaceship, Inc.
Registered On: November 26, 2024
Expires On: November 26, 2025
Updated On: November 26, 2024
Status: clientTransferProhibited, serverTransferProhibited, addPeriod
Nameservers: yangyang.ns.giantpanda.com, lunlun.ns.giantpanda.com

Technical Analysis:

Frameworks: The website uses modern web frameworks that make it appear professional and legitimate, which is a common tactic in scams to avoid suspicion.
DNS Hosting: The nameservers (yangyang.ns.giantpanda.com, lunlun.ns.giantpanda.com) are hosted by an obscure provider, “giantpanda.com,” which is often used by scammers to hide their true infrastructure and obfuscate the origin of the site.
Domain Status: The use of “clientTransferProhibited” and “serverTransferProhibited” status means that the domain is locked, making it difficult for authorities to transfer or modify the domain registration, a tactic often used to avoid detection.
Key Observations:
The website’s use of obscure nameservers and a newly registered domain (November 2024) suggests the scammers are attempting to maintain anonymity. Additionally, the “clientTransferProhibited” and “serverTransferProhibited” statuses indicate a deliberate effort to keep the domain and hosting secure from investigation or transfer.

Recommendations:
Spaceship, Inc.: A subpoena should be issued to obtain detailed information about the domain’s registration and the identity of the domain owner.
Blockchain Forensics: Investigate the wallet addresses involved in this scam to trace any movement of funds and identify further links to other fraudulent activities or victim wallets.
Nameserver Investigation: Investigate the “giantpanda.com” nameservers and the associated infrastructure to gather more information on the scammers’ hosting arrangements.

Conclusion:
The website byokcrypto.co is a fraudulent cryptocurrency investment platform that deceives victims by promising high returns. After the victim deposited funds, they were unable to withdraw their money or receive any promised returns. The use of newly registered domain details and obscure nameservers is a tactic commonly used by scammers to hide their operations. Immediate action should be taken to subpoena the domain registrar and investigate the wallet addresses and hosting provider.

Scam Details:
The victim was misled into transferring 44,823 USDT (equivalent to $44,797) to a fraudulent investment platform, ByokCrypto. Promised high returns were never realized, and the funds became irretrievable, exposing the platform as an investment scam.

Domain Information Analysis:

Domain: byokcrypto.co
Registrar: Spaceship, Inc.
Nameservers: GoDaddy.com, LLC
Registration Details: Registered on November 26, 2024; set to expire on November 26, 2025.
Registrant Contact: Privacy service provided by Withheld for Privacy ehf (Capital Region).
The domain’s recent registration and use of a privacy protection service strongly suggest it was specifically created to carry out fraudulent activities.

Receiving Cryptocurrency Address:

USDT: 0xa5e6bb93371e2c8FB3BFb68Cb2B0996e7792D93a
Recommended Actions:

Report to Cryptocurrency Exchanges: Inform the originating exchanges of the fraudulent transaction, providing details of the USDT address and transaction ID. This may assist in tracking or freezing associated funds.

Contact Law Enforcement: File a report with local law enforcement or cybercrime units, including all transaction details, communications with the platform, and the domain information.

Consult Legal Experts: Engage a legal professional experienced in cryptocurrency scams for guidance on potential recovery methods or legal action.

Monitor Digital Assets: Secure remaining cryptocurrencies in a reputable and secure wallet. Consider enabling alerts for suspicious activity related to the scam address.

Raise Public Awareness: Share details about the scam on cryptocurrency forums, social media, and scam-reporting platforms to help warn others about ByokCrypto.

Conclusion:
ByokCrypto caused a financial loss of $44,797 through fraudulent investment practices. Prompt reporting to exchanges, law enforcement, and consulting legal experts is crucial. Increasing public awareness can help prevent others from falling victim to the same scam.