Article: A criminal syndicate has set up 15,500 websites that stream deep-fake videos of well-known personalities touting bogus stock tips, and the operation is already siphoning money from unsuspecting investors. The scale alone makes manual takedown impossible, forcing security teams to rethink how they spot and block such fraud.
How the ring operates
The scammers do not rely on a single fake clip. Each site is programmed to behave differently depending on who visits it. An automated crawler sees a bland “under construction” page, while a real user arriving on a mobile device is served a polished video that appears to feature a celebrity endorsing a stock. The discrepancy lets the operation stay under the radar of traditional web-scraping tools.
To hide the switch, the group uses traffic-routing services such as Keitaro, which can cloak URLs and serve different content based on IP reputation, device fingerprint, or referrer header. The result is a massive network of “look-alike” domains that blend into the normal web, making it hard for security bots to flag them as malicious.
Why standard detection falls short
Most anti-deep-fake solutions focus on spotting visual artefacts that betray a synthetic video—blurry edges, inconsistent lighting, or mismatched lip sync. In this campaign, those cues are rare because the videos are rendered with high-quality models. The real vulnerability lies in the geometry of the face: deep-fake generators often introduce subtle discrepancies in the spatial relationship between facial landmarks.
A simple “is this video fake?” check therefore misses many of the ring’s content. What’s needed is a verification step that compares the face shown in the video against a known, trusted image of the celebrity.
Building a verification pipeline
Developers can embed three core capabilities into their security workflows:
- Adaptive crawling – Use headless browsers that mimic real user agents, rotate IPs, and emulate mobile device characteristics. This helps bypass the “under construction” decoys and retrieve the actual video payload.
- Biometric comparison – Extract facial landmarks from each frame of the video and compute Euclidean distances to those of an authentic reference photo. Small, consistent errors in landmark placement are a strong indicator of a deep-fake. Running the comparison across multiple frames reduces false positives caused by momentary occlusions or lighting changes.
- Shift from detection to verification – Instead of flagging a video as “potentially fake,” treat it as unverified until it passes the biometric check against a vetted source. If no match is found, the content can be quarantined or sent for human review.
A practical implementation might look like this:
- Crawler fetches the page, follows redirects, and records the final video URL.
- Downloader pulls the video and splits it into key frames (e.g., one per second).
- Face extractor runs a lightweight model to locate the face in each frame.
- Landmark matcher calculates the Euclidean distance between extracted landmarks and those from an official portrait of the celebrity.
- Score aggregator flags the video if the median distance exceeds a predefined threshold.
Because the operation spans thousands of domains, automating each step is essential. Open-source libraries for face detection and landmark extraction are readily available, and the Euclidean-distance calculation is computationally cheap, allowing the pipeline to scale to tens of thousands of sites per day.
Potential pushback
Some security teams argue that biometric verification raises privacy concerns, especially when it involves storing reference images of public figures. The counter-argument is that the reference set can be limited to publicly available, licensed photos and never persisted beyond the comparison step. The risk of millions of users being duped out of investment funds outweighs the modest data handling involved.
Another objection is the maintenance overhead of keeping the reference library up to date as celebrities change their appearance. Incremental updates—adding new headshots as they appear in verified media—mitigate this issue without requiring a full rebuild.
What to watch next
La dépendance du réseau à l'égard des services de masquage de trafic signifie que toute interruption de ces services pourrait temporairement affaiblir la campagne, mais la technique sous-jacente — la diffusion de contenu dynamique couplée à des deepfakes de haute qualité — réapparaîtra probablement dans d'autres escroqueries. Les fournisseurs de sécurité devraient surveiller des schémas similaires : un contenu divergent basé sur les signatures de crawlers, des pics soudains de domaines pointant vers le même bucket d'hébergement vidéo, et l'utilisation répétée des mêmes signatures d'erreurs de géométrie faciale.
Pour les développeurs, la prochaine étape consiste à prototyper le pipeline de vérification sur un petit sous-ensemble de domaines suspects et à mesurer les taux de faux positifs. Le partage des signatures de détection entre les organisations peut également réduire la duplication des efforts.
À retenir : L'escroquerie aux deepfakes impliquant 15 500 sites illustre que l'échelle, et pas seulement la sophistication, constitue la nouvelle frontière de la fraude. En combinant le crawling adaptatif avec une vérification biométrique image par image, les équipes de sécurité peuvent transformer un problème accablant en une défense automatisée et mesurable.