Article: A criminal syndicate has set up 15,500 websites that stream deep-fake videos of well-known personalities touting bogus stock tips, and the operation is already siphoning money from unsuspecting investors. The scale alone makes manual takedown impossible, forcing security teams to rethink how they spot and block such fraud.
How the ring operates
The scammers do not rely on a single fake clip. Each site is programmed to behave differently depending on who visits it. An automated crawler sees a bland “under construction” page, while a real user arriving on a mobile device is served a polished video that appears to feature a celebrity endorsing a stock. The discrepancy lets the operation stay under the radar of traditional web-scraping tools.
To hide the switch, the group uses traffic-routing services such as Keitaro, which can cloak URLs and serve different content based on IP reputation, device fingerprint, or referrer header. The result is a massive network of “look-alike” domains that blend into the normal web, making it hard for security bots to flag them as malicious.
Why standard detection falls short
Most anti-deep-fake solutions focus on spotting visual artefacts that betray a synthetic video—blurry edges, inconsistent lighting, or mismatched lip sync. In this campaign, those cues are rare because the videos are rendered with high-quality models. The real vulnerability lies in the geometry of the face: deep-fake generators often introduce subtle discrepancies in the spatial relationship between facial landmarks.
A simple “is this video fake?” check therefore misses many of the ring’s content. What’s needed is a verification step that compares the face shown in the video against a known, trusted image of the celebrity.
Building a verification pipeline
Developers can embed three core capabilities into their security workflows:
- Adaptive crawling – Use headless browsers that mimic real user agents, rotate IPs, and emulate mobile device characteristics. This helps bypass the “under construction” decoys and retrieve the actual video payload.
- Biometric comparison – Extract facial landmarks from each frame of the video and compute Euclidean distances to those of an authentic reference photo. Small, consistent errors in landmark placement are a strong indicator of a deep-fake. Running the comparison across multiple frames reduces false positives caused by momentary occlusions or lighting changes.
- Shift from detection to verification – Instead of flagging a video as “potentially fake,” treat it as unverified until it passes the biometric check against a vetted source. If no match is found, the content can be quarantined or sent for human review.
A practical implementation might look like this:
- Crawler fetches the page, follows redirects, and records the final video URL.
- Downloader pulls the video and splits it into key frames (e.g., one per second).
- Face extractor runs a lightweight model to locate the face in each frame.
- Landmark matcher calculates the Euclidean distance between extracted landmarks and those from an official portrait of the celebrity.
- Score aggregator flags the video if the median distance exceeds a predefined threshold.
Because the operation spans thousands of domains, automating each step is essential. Open-source libraries for face detection and landmark extraction are readily available, and the Euclidean-distance calculation is computationally cheap, allowing the pipeline to scale to tens of thousands of sites per day.
Potential pushback
Some security teams argue that biometric verification raises privacy concerns, especially when it involves storing reference images of public figures. The counter-argument is that the reference set can be limited to publicly available, licensed photos and never persisted beyond the comparison step. The risk of millions of users being duped out of investment funds outweighs the modest data handling involved.
Another objection is the maintenance overhead of keeping the reference library up to date as celebrities change their appearance. Incremental updates—adding new headshots as they appear in verified media—mitigate this issue without requiring a full rebuild.
What to watch next
ההסתמכות של הרשת על שירותי הסתרת תעבורה פירושה שכל שיבוש בשירותים אלו עלול להחליש זמנית את הקמפיין, אך הטכניקה שבבסיסו — אספקת תוכן דינמית בשילוב עם deep-fakes באיכות גבוהה — ככל הנראה תופיע שוב בהונאות אחרות. ספקי אבטחה צריכים לעקוב אחר דפוסים דומים: תוכן שונה המבוסס על חתימות של crawlers, קפיצות פתאומיות במספר הדומיינים המפנים לאותו video hosting bucket, ושימוש חוזר באותן חתימות של שגיאות בגיאומטריית הפנים.
עבור מפתחים, הצעד הבא הוא לבנות אב-טיפוס של תהליך האימות (verification pipeline) על תת-קבוצה קטנה של דומיינים חשודים ולמדוד את שיעורי ה-false-positive. שיתוף חתימות זיהוי בין ארגונים יכול גם הוא לצמצם כפילות במאמצים.
שורה תחתונה: הונאת ה-deep-fake שכללה 15,500 אתרים ממחישה שהיקף (scale), ולא רק תחכום, הוא החזית החדשה של ההונאה. על ידי שילוב של adaptive crawling עם אימות ביומטרי פרייים-אחר-פרייים (frame-by-frame), צוותי אבטחה יכולים להפוך בעיה מציפה להגנה אוטומטית ומדידה.