Cybersecurity researcher unravels sophisticated layers of colour-prediction scam

Cut off one headrdquo said the evil HYDRA operative in Captain America The First Avenger ldquoand two more will take its placerdquoFor the last one month a 26yearold cybersecurity researcher from Madhya Pradesh has been discovering pretty much this about a widespread cyberscam that was last busted four years ago In 2020 the Hyderabad police called out the ldquocolour predictionrdquo scammdasha longdrawn internetbased con job that lures people into ldquoinvestingrdquo money by asking them to guess a colour and win money The scamrsquos spoils totalled Rs 1600 crore and the links were traced all the way to China where the mastermind was allegedly operating fromThree months ago Ketan Raikwar a bug bounty hunter from Indore noticed a sudden influx of paid ads on Instagram all of them leading to websites that promoted colourprediction lotteries Raikwar who shared his findings exclusively with midday explained ldquoThe ads take you to a website with a lsquoregistrationrsquo page To register you have to pay a small amount say Rs 100 You bet on a colour and if it pops up on screen when you play the lsquogamersquo you win Like other scams of this nature the victims are paid Rs 200 or some such Ridiculously simple but the perpetrators rake in croresrdquoWhat makes this one different from other investment scams currently trending he adds is that most of them make the victims do some work like leaving behind positive feedback on products or lsquolikingrsquo YouTube videos in exchange for the initial pay out Here the victim has to simply guess a colour which leads himher to think what could go wrongAs soon as the first ldquobetrdquo is ldquowonrdquo the perpetrator adds the victim to a Telegram group Here she is given ldquoinsider tipsrdquo on which colour to place the next bet on The victim accepts the tips and also ldquowinsrdquo in the first instance This makes him believe they he has found a shortcut to riches Next comes the lure of bigger returns for bigger ldquoinvestmentsrdquo which start at Rs 10000 For every deposit the victim makes the app shows double the returns But this money can never be withdrawn nor is it deposited into his bank accountWhen Raikwar noticed the ads he reached out to the ethical hacker community and together they delved deep into five websites over one month while also examining scores of Instagram accounts that promoted these websites ldquoWe found that the influencers were getting commissions or cuts from the money that the victims were payingrdquo says Raikwar ldquoFor example if 10 people registered with the website using a referral code shared by one influencer the influencer got a percentage of the amount that the victim lost It is like a multilevel marketing chain the victims lose money every dayrdquoA Telegram group that is part of the scam right An Instagram profile promoting the scamUsing their bug bounty hunting skills Raikwar and his collaborators who prefer to remain anonymous sniffed around the edges of the website till they found a vulnerability that let them hack one Through this backdoor they accessed the account of a person promoting the website on social media This section had details of how many people the promoter had lured so far how much money they had paid how much commission the promoter who was categorised as a ldquoLevel 6 VIPrdquo had been paid and how much he was owedldquoWe were shocked by the findingsrdquo he says ldquoA total of 64306 people had paid Rs 59 crore And this is to just one promoter of one websiterdquo Raikwar shared screenshots of his discovery with midday and this writer saw that a sum of Rs 85 lakh had been earmarked as ldquocommissionsrdquo in the same sectionHe also made another serious discovery while searching for the extent of the internet scam The scammers have hacked multiple Bihar government websites and posted ads for their scams on these pages Even in a Google search the preview text includes promotions like ldquoMost trusted colour prediction apprdquo see image ldquoThese are the top results thrown up by a search engine whenever one searches for themrdquo he saysThe preference for anonymity is not without reason Ever since the pandemic began Raikwar and his fellow researchers have been flagging online scams to the cyber police in various states and they now find themselves on the radar of the scammers Three times this year Raikwar created Instagram pages to raise awareness about cyberscams Every time the pages were reported to Meta en masse and the tech giant disabled the pages because of the sheer volume of reports ldquoBut our efforts are also encouraging others to speak up People have been reaching out to us via social media and some of the stories are heartbreaking The most recent one was about a teenager who stole R50000 from his parents hoping to make one lakh rupees and has now run away from home because he is scared to face themrdquo Raikwar tells middayPeople are speaking up on other platforms too On a recent Reel posted as a paid ad by an influencer over 4000 people have left comments asking him to either give them the returns he promised or have their money refunded ldquoThe money is long gone of courserdquo says Raikwar ldquoSuch scammers donrsquot keep money in a single account for longrdquoHow hard is it we ask to design a dummy game to fool people Raikwar laughs ldquoThe entire source code is available for free online Not just that there are people who design these websites for as low as Rs 300 to Rs 500 It is an entire ecosystem at workrdquoRaikwar has turned over his findings via email to the cyber police in MP Maharashtra and Delhi requesting action He says he will continue to probe deeper in the meantime