Thousands of Ukraine-related domains registered as scammers try to profit from the war

Scam artists and other bad actors are once again up to their old tricks in pursuit of ill-gotten profits, and this time they have set their sights on Ukraine. In order to take advantage of the ongoing war in the country, they use an old reliable tool to deceive Internet users: domain names.

More than 4,200 domain names related to Ukraine have been registered since Russian troops invaded the country last week, according to domain monitoring service DomainTools.

DomainTools has been monitoring newly registered domain names containing the terms “Ukraine” or “Ukrainian” within the past week. The company has made this data freely available to the public.

Conflict-related domain name registrations continued to grow, including to jump from 46 domains on February 24, the day the Russian invasion began, to more than 200 the following day.

It is important to note that not all of these domain name registrations are malicious. However, preliminary data research by DomainTools and Mashable uncovered a number of probable scams. Hours after the February 24 invasion, DomainTools discovered URLs, such as “” and “”, configured to receive donations for unspecified organizations. the Federal Trade Commission cautions against these kinds of emotionally charged appeals for donations that don’t include details of how the money will be used.

Mashable has discovered similar Ukraine-related domains being used for apparent scams, particularly those related to cryptocurrency. “” was registered eight days ago. A website at the URL was quickly set up using the Wix hosting service. Donation links and QR codes can be found on the site, which sends users to specific crypto wallets for Bitcoin, Ethereum, Dogecoin, and a number of other tokens.

“Crypto fundraiser for all victims of the horrific events” reads the website, with no mention of where these donations are going. A Google search for the Bitcoin wallet address provided found it listed on a website where users can report crypto scams. At the time of publishing, the website no longer resolves to the domain level.

Another website posing as a crypto fundraiser for Ukraine, “” lists a number of wallet addresses that have not been shared online before. The website also does not specify which organization these donations will apparently go to.

Like Shoshana Wodinsky from Gizmodo sharp On Twitter, other registered URLs related to the conflict in Ukraine seem to point to other possible scams. A domain pointed to a website for “Ukraine Brides”. Another URL redirected users to real estate listings in neighboring countries.

Nefarious actors have long used URLs as weapons to scam users with money or steal their personal information. This tactic exploded during the COVID-19 pandemic, for example, when thousands of domain names were registered to promote COVID-19 vaccines to trick people into thinking they were visiting official health websites.

If you are looking for legit Ukrainian aid organizations to donate to, you can find them here.

Comments are closed.