Deposit and investment fraud
Fake fixed-term deposit, CFD, crypto and pre-IPO services use convincing onboarding documents and route payments to accounts controlled by offenders.
Protecting people and legitimate identities online
We document fraudulent investment infrastructure and report it to the organisations able to stop it.
Criminal groups use cloned company identities, deceptive advertising, fake trading interfaces and malicious software to steal savings and personal data. Liberty Board correlates the technical evidence and prepares precise reports for registrars, hosting providers, advertising platforms, certification providers and competent authorities.
Our workflow preserves SHA-256 evidence, traces registrar and hosting infrastructure, identifies related domains and records advertising-account links. Actions remain subject to the receiving provider's terms, applicable law and any lawful authority request.
White Hat mandate
Ethical security research, with clear limits
Defensive purpose
We analyse publicly observable infrastructure and lawfully submitted evidence. We do not attack systems, bypass access controls or claim powers we do not have.
Evidence integrity
Timestamps, RDAP and DNS data, screenshots, redirects and submitted backups are recorded with cryptographic hashes and a documented chain of custody.
Independent status
Liberty Board is not a government authority. We submit verified material to competent providers, CERTs, regulators and law-enforcement bodies where appropriate.
Threat intelligence
Fraud and malicious-software patterns we investigate
Clone firms and brand abuse
Fraudsters copy company names, registry entries and genuine regulatory references while operating from an unrelated domain.
Phishing kits and web skimmers
Malicious JavaScript, adversary-in-the-middle login pages and credential-harvesting forms target banking data and multi-factor tokens.
Remote-access abuse
Call-centre operators misuse remote-support software to observe online banking sessions and manipulate transfers.
Deceptive advertising
Cloaking and verified advertiser accounts can present benign content to reviewers while sending victims to fraudulent funnels.
Recovery scams
Victims are targeted again by impersonated authorities or recovery firms demanding advance fees for fictitious frozen funds.
Advertising ecosystem
Domain hopping and advertiser correlation
Removing one domain may not stop a campaign. Operators can move the same content to a new .com, .net or other top-level domain while retaining the same advertising identity. We correlate related domains, infrastructure fingerprints and public Google Ads Transparency information.
1. Registrar: report all evidenced domains and request review under the registrar's abuse policy.
2. Hosting provider: request containment and preservation of relevant data, subject to applicable law.
3. G2 Risk Solutions: report suspected misuse of financial-services advertiser verification.
4. Google Ads: report circumvention, impersonation and the linked advertiser account—not only the current landing page.
Provider evidence-preservation request
Contain, preserve, then disable public access
Where legally permitted, hosting providers receiving a substantiated report are asked to preserve relevant evidence before routine deletion. This is a preservation request—not a court order—and providers should follow applicable law, their terms and lawful authority requests.
01 // CONTAIN
Restrict offender access and prevent alteration or automated destruction where the provider's policy and law permit.
02 // PRESERVE
Preserve relevant web files, databases, access logs and account records. A case-bound, write-only upload link may be supplied for an encrypted evidence hand-off.
03 // DISABLE
Disable public routing or apply an appropriate domain status, then confirm the action and preservation status.
Immediate guidance
For victims
Stop further payments, contact your bank immediately to request a fraud recall, revoke remote access, change passwords, preserve communications and report the matter to police.
For impersonated organisations
Record the unrelated domain, copied registry details, payment instructions and advertisements. Notify customers, your regulator and the relevant infrastructure providers.
For authorities and media
Reference the public case identifier when requesting available evidence. Sensitive material is not published and is shared only through an appropriate verified channel.
Public verification and warning registry
Documented domains and case status
Public references are opaque and non-sequential. Publication documents our assessment; it is not a judicial finding.
| Reference | Domain | Issue | Registrar / host | Related domains | Evidence | Status |
|---|---|---|---|---|---|---|
| LB-2026-6646B7DB | zinskontor.com | Fake-Anlageplattform / Krypto- & Festgeld-Betrug | DotWee Limited G-Core Labs Customer assignment |
1 | fb27cb4643ea590ac26b… | Reported / online |
| LB-2026-04D71B2D | festgeld-welt.com | Fake-Anlageplattform / Krypto- & Festgeld-Betrug | Spaceship, Inc. Flash Wireless ISP Enterprises |
0 | 11ce4179c68da25a50f9… | Reported / online |
| LB-2026-215E33CE | paradigmcapital24.com | Fake-Anlageplattform / Krypto- & Festgeld-Betrug | Spaceship, Inc. Private Customer |
0 | 54b1dc2d37e140b8f569… | Reported / online |
| LB-2026-F578BBB7 | renditezinsen.com | Fake-Anlageplattform / Krypto- & Festgeld-Betrug | DotWee Limited G-Core Labs Customer assignment |
0 | ecf785115afd4a85cbb1… | Reported / online |
| LB-2026-9941EBDE | festgeldpilot24.org | Fake-Anlageplattform / Krypto- & Festgeld-Betrug | DotWee Limited G-Core Labs Customer assignment |
2 | d8964493ca41255a4bed… | Reported / online |
| LB-2026-4CA1A0AD | festgeldinfo24.com | Fake-Anlageplattform / Krypto- & Festgeld-Betrug | Internet Domain Service BS Corp DDOS-GUARD LTD |
0 | 13dc386b39ec7f5257d4… | Reported / online |
| LB-2026-343B8A0F | festgeldtrend.com | Fake-Anlageplattform / Krypto- & Festgeld-Betrug | CNOBIN INFORMATION TECHNOLOGY LIMITED DDOS-GUARD LTD |
0 | 9c035eedf2535ba69e4c… | Reported / online |
Confidential reporting desk
Report a fraudulent platform or identity abuse
Reports are reviewed before any external escalation. Anonymous reports are accepted.