Article: A criminal syndicate has set up 15,500 websites that stream deep-fake videos of well-known personalities touting bogus stock tips, and the operation is already siphoning money from unsuspecting investors. The scale alone makes manual takedown impossible, forcing security teams to rethink how they spot and block such fraud.
How the ring operates
The scammers do not rely on a single fake clip. Each site is programmed to behave differently depending on who visits it. An automated crawler sees a bland “under construction” page, while a real user arriving on a mobile device is served a polished video that appears to feature a celebrity endorsing a stock. The discrepancy lets the operation stay under the radar of traditional web-scraping tools.
To hide the switch, the group uses traffic-routing services such as Keitaro, which can cloak URLs and serve different content based on IP reputation, device fingerprint, or referrer header. The result is a massive network of “look-alike” domains that blend into the normal web, making it hard for security bots to flag them as malicious.
Why standard detection falls short
Most anti-deep-fake solutions focus on spotting visual artefacts that betray a synthetic video—blurry edges, inconsistent lighting, or mismatched lip sync. In this campaign, those cues are rare because the videos are rendered with high-quality models. The real vulnerability lies in the geometry of the face: deep-fake generators often introduce subtle discrepancies in the spatial relationship between facial landmarks.
A simple “is this video fake?” check therefore misses many of the ring’s content. What’s needed is a verification step that compares the face shown in the video against a known, trusted image of the celebrity.
Building a verification pipeline
Developers can embed three core capabilities into their security workflows:
- Adaptive crawling – Use headless browsers that mimic real user agents, rotate IPs, and emulate mobile device characteristics. This helps bypass the “under construction” decoys and retrieve the actual video payload.
- Biometric comparison – Extract facial landmarks from each frame of the video and compute Euclidean distances to those of an authentic reference photo. Small, consistent errors in landmark placement are a strong indicator of a deep-fake. Running the comparison across multiple frames reduces false positives caused by momentary occlusions or lighting changes.
- Shift from detection to verification – Instead of flagging a video as “potentially fake,” treat it as unverified until it passes the biometric check against a vetted source. If no match is found, the content can be quarantined or sent for human review.
A practical implementation might look like this:
- Crawler fetches the page, follows redirects, and records the final video URL.
- Downloader pulls the video and splits it into key frames (e.g., one per second).
- Face extractor runs a lightweight model to locate the face in each frame.
- Landmark matcher calculates the Euclidean distance between extracted landmarks and those from an official portrait of the celebrity.
- Score aggregator flags the video if the median distance exceeds a predefined threshold.
Because the operation spans thousands of domains, automating each step is essential. Open-source libraries for face detection and landmark extraction are readily available, and the Euclidean-distance calculation is computationally cheap, allowing the pipeline to scale to tens of thousands of sites per day.
Potential pushback
Some security teams argue that biometric verification raises privacy concerns, especially when it involves storing reference images of public figures. The counter-argument is that the reference set can be limited to publicly available, licensed photos and never persisted beyond the comparison step. The risk of millions of users being duped out of investment funds outweighs the modest data handling involved.
Another objection is the maintenance overhead of keeping the reference library up to date as celebrities change their appearance. Incremental updates—adding new headshots as they appear in verified media—mitigate this issue without requiring a full rebuild.
What to watch next
A dependência do grupo em serviços de mascaramento de tráfego significa que qualquer interrupção nesses serviços pode enfraquecer temporariamente a campanha, mas a técnica subjacente — entrega de conteúdo dinâmico combinada com deepfakes de alta qualidade — provavelmente reaparecerá em outros golpes. Fornecedores de segurança devem monitorar padrões semelhantes: conteúdo divergente baseado em assinaturas de crawlers, picos repentinos de domínios apontando para o mesmo bucket de hospedagem de vídeo e o uso repetido das mesmas assinaturas de erro de geometria facial.
Para desenvolvedores, o próximo passo é prototipar o pipeline de verificação em um pequeno subconjunto de domínios suspeitos e medir as taxas de falsos positivos. O compartilhamento de assinaturas de detecção entre organizações também pode reduzir a duplicidade de esforços.
Conclusão: O golpe de deepfake de 15.500 sites ilustra que a escala, e não apenas a sofisticação, é a nova fronteira para a fraude. Ao combinar crawling adaptativo com verificação biométrica quadro a quadro, as equipes de segurança podem transformar um problema esmagador em uma defesa automatizada e mensurável.