Trace the Scam Back to Its Cheap VPS: Infrastructure OSINT for Fraud Fighters
scammers are cheap. that is the single best thing about them. they register a domain for ninety-nine cents, park it on a bulletproof-ish vps that also hosts eight of their friends’ scams, answer a twilio number, and take payment to a wallet they reuse across victims. every one of those cost-saving decisions is a pivot point. you do not need to hack anyone to follow the trail. you need whois, passive dns, and the common-input heuristic.
start with what the scam handed you
a scam gives you artifacts for free: the phone number that called, the domain in the email, the IP a link resolved to, the crypto address or bank detail they wanted money sent to. each is a thread. you pull them in a specific order so one pivot feeds the next.
the phone number and the domain
run the number through phone osint first. a toll-free voip line (twilio, bandwidth, a reseller) tells you it is a disposable call-center number, not a person. then whois the domain. the two things that matter most: creation date and the registrar abuse contact. a domain registered last week is a scam tell by itself. legitimate businesses rarely cold-call you from a domain younger than milk.
the pivot that does the work: passive dns
here is where cheapness pays off for you. passive dns (dnsdbq against the farsight/dnsdb style datasets, or free tiers like securitytrails, validin, or silentpush) lets you resolve the domain to an ip, then reverse the ip to see every other domain that has ever lived on it.
scammers reuse hosting because moving is annoying and cheap vps providers do not ask questions. so one reverse-ip pivot often lights up the whole brand family: the paypal typosquat, the mcafee “refund center,” the norton “billing help,” all cohabiting on one ipv4. now you are not reporting one domain, you are reporting a cluster. whois on the ip gives you the hosting org and, crucially, its abuse email.
the money: wallet clustering without a blockchain degree
if they took crypto, the ledger is public and permanent, which is hilarious for an industry built on “untraceable.” the workhorse technique is the common-input-ownership heuristic: when multiple addresses are spent together as inputs to one transaction, they are almost certainly controlled by the same wallet. that collapses a pile of “different” deposit addresses into one actor.
tools: walletexplorer for quick clustering, the free tiers of chainalysis-style explorers, or just a graph of co-spends. the real prize is the cash-out point. when funds hit a kyc exchange, that exchange has an identity behind the account, and that is exactly the lead ic3 or a subpoena can run down. you are not recovering the money. you are drawing the map someone with a badge can follow.
what defenders and victims can do
- build an evidence pack: number, domains (with creation dates), ip, hosting org, wallet cluster, and utc timestamps for everything. screenshots with visible urls. hashes for any files.
- find the abuse inboxes: registrar abuse, hosting abuse, and the exchange’s compliance/law-enforcement portal. those are the levers that actually take infrastructure down.
- report, do not retaliate: send the pack to the right places (next article in this series). one tidy report to a hosting abuse team beats a week of angry tweets.
sloth take
the scam industry runs on the assumption that nobody will spend twenty minutes pivoting a domain to an ip to a wallet. prove them wrong. the infrastructure is cheap, reused, and loud. you will not personally arrest anyone, but you can turn a vague “i got scammed” into a mapped cluster with abuse contacts attached, which is the only thing that moves the needle.
want infrastructure osint and takedown workflows built into your fraud or IR program? Book Dark Edge Consulting.
sources
- Farsight DNSDB / dnsdbq passive DNS documentation; free passive DNS tiers (SecurityTrails, Validin, Silent Push)
- ICANN WHOIS and registrar abuse contact requirements
- Common-input-ownership heuristic (Bitcoin wallet clustering), WalletExplorer
- FBI IC3 and exchange law-enforcement request processes
- Lab artifacts generated on-box 2026-10-17 (synthetic pivots and terminal captures)
