COVID-19 fraud domain seized from seller who attempted to sell it using bitcoin

PHILADELPHIA — U.S. Immigration Customs and Enforcement’s (ICE) Homeland Security Investigations (HSI) and United States Attorney’s Office for the District of Columbia obtained a warrant Friday authorizing seizure of coronaprevention.org following an HSI Philadelphia investigation in support of Operation Stolen Promise. HSI recently launched Operation Stolen Promise to protect the homeland and global supply-chain from the increasing and evolving threat posed by COVID-19-related fraud and criminal activity by combining HSI’s expertise in global trade investigations, financial fraud, and cyber investigations with robust private and public partnerships.

The seizure warrant alleges that the owner of the domain name, coronaprevention.org, posted it for sale on a hackers forum. The post appeared the day after the president declared a national emergency due to the COVID-19 pandemic. The seller stated on the forum that this domain would be an effective way to sell “high markup in demand products.” The seller exponentially marked up the price of the domain. The seller asked for the payment to be made via bitcoin.

The warrant further alleges that the seller engaged in conversations with an undercover agent from HSI about the sale of the domain. The seller stated that it was “genius” to sell “fake testing kits” using this domain. The seller further stated that the seller “wanted to do that but I couldn’t get enough cash to bulk buy them from Alibaba [a Chinese e-commerce site].” The seller recommended directed the undercover agent on how to set up a new website on the domain using a foreign-based service, so as to prevent U.S. authorities from being able to shut it down in the future.

“We will not tolerate exploitation of this national emergency for personal gain,” said U.S. Attorney Tim Shea. “This office will not allow fraudsters to use anonymous online spaces and cryptocurrency to hide their harmful activities and prey on victims.”

The charges in the warrant are merely allegations, and civil forfeiture proceedings will commence in which any interested party may make a claim to ownership of the seized property. The enforcement action against the owner of a fraudulent website follows Attorney General William Barr’s recent direction for the department to prioritize the detection, investigation, and prosecution of illegal conduct related to the pandemic.

The case is being handled by Assistant U.S. Attorney Zia M. Faruqui, Paralegal Specialist Brian Rickers, and Legal Assistant Jessica McCormick of the U.S. Attorney’s Office for the District of Columbia.

As part of Operation Stolen Promise, HSI is partnering with U.S. Customs and Border Protection (CBP), the Food and Drug Administration, the U.S. Postal Inspection Service, the U.S. Secret Service, the Internal Revenue Service, the Federal Bureau of Investigation, and the Five Eyes Law Enforcement Working Group. Additionally, efforts span multiple HSI components including the National Intellectual Property Rights Coordination Center, HSI International Operations, the Illicit Finance and Proceeds of Crime Unit, and the Cyber Crimes Center.

As of April 23, 2020, HSI special agents have opened over 232 cases initiated, 376 total seizures, 329 leads sent, 70 disruptions, seized over three million dollars in illicit proceeds; made six arrests; executed 12 search warrants; referred over 11,000 COVID-19 suspected fraudulent domain names for appropriate disruption action and worked alongside CBP to seize over 225 shipments of mislabeled, fraudulent, unauthorized or prohibited COVID-19 test kits, treatment kits, homeopathic remedies, purported anti-viral products and personal protective equipment. The launch of the operation is in direct response to a significant increase in criminal activity.