A Philippines-based network of fraudulent websites posing as wealth management firms, investment holding companies, stock transfer agencies, and corporate advisory services. The sites target victims by presenting themselves as established financial institutions offering portfolio management, securities trading, and corporate registrar services, using fabricated credentials, fake regulatory registrations, and professional client login portals to solicit deposits. This network operates across multiple infrastructure tiers and has been linked to at least 38 domains across several front companies.
The Crimson Osprey network is a Philippines-based operation running fraudulent financial services websites across multiple front companies. The network spans at least 38 confirmed domains operating under fabricated company identities in multiple jurisdictions. The operation uses two distinct infrastructure tiers with different technology stacks, both serving the same purpose of impersonating legitimate financial institutions. One tier uses legacy web technology rarely seen in modern operations, while the other uses a more contemporary stack. Both tiers employ professional-looking client portals designed to collect credentials and deposits from victims. The operator has been active since at least 2006 and deliberately compartmentalizes domains across multiple hosting and DNS providers in different countries to reduce the impact of takedowns on the overall operation. Law enforcement action has been taken against individuals associated with this network.
AI-generated summary
Category
CFD/ForexBrands
0Domains
Down domains
53Unique IPs
34Detection signals
0Status
activeDate range
Apr 2026 — May 2026Domains in this network have been flagged by financial regulators across 1 country.
Encountered a site from this network?
Your report helps us track and expose these operations.