February 14, 2025
Valentine’s Day is a great time to celebrate love whether you are in a relationship or single. However, there can be a darker side to Valentine’s Day – while many celebrate romance, others target those wanting to feel loved or special by someone.
The FBI defined romance scams (pig butchering) as when a “criminal uses a fake online identity to gain a victim’s affection and trust. The scammer then uses the illusion of a romantic or close relationship to manipulate and/or steal from the victim.”
The FTC (Federal Trade Commission) explained that romance “scammers create fake profiles on dating sites and apps or contact you through popular social media sites like Instagram or Facebook. The scammers strike up a relationship with you to build up trust, sometimes talking or chatting several times a day. Then, they make up a story and ask for money.”
Romance scammers are no different than other scammers – they quickly gain rapport with their targets before taking full advantage of them. It is not uncommon for romance scammers to be well versed in other types of fraud like check fraud. According to the FTC, there are specific tactics these scammers employee to quickly gain rapport with their targets. It is key for the scammer to manipulate their target by giving the victim the impression they have a genuine connection.
In this blog, we will examine not only how romance scams and pig butchering are often mentioned across the darknet, but we will also look at various types of data scammers look for to identify their targets.
How do Cyber Criminals find their Targets?
Adult Website SEO Traffic
One method romance scammers use to identify victims is targeting adult website Search Engine Optimization (SEO) traffic leads and databases. The following popular XSS thread was originally published in 2020 but was still receiving replies as recent as January 2025. The thread highlights how romance scammers utilize adult website SEO traffic to find potential targets when the user claimed, “there is over 3000+ people in my network that are active and above the age of 20.”:
OnlyFans is allegedly another effective site to target for identifying new potential victims. The following user on the popular hacking forum, Black Hat World, advised other scammers to connect with other fraudsters on sites like SEOClerk and Juicy Ads where users sell access to OnlyFans traffic.
While the above examples demonstrate fraudsters exchanging information with each other, it is also common to see tutorials for sale on darknet marketplaces. The below screenshot shows a listing of a tutorial of how to monetize adult website SEO traffic. This was listed on TorZon Marketplace on January 20, 2025:
Scammers will also sell services related to targeting adult SEO traffic. The following post from the now defunct Cracked.io shows a user advertising their SEO traffic service for $300 USD a day. The users provided an explanation of one methodology of how to monetize adult website SEO traffic for romance scams alleging that Reddit is a good place to start your scam:
Romance scams are commonly discussed on popular hacking forums like XSS, BreachForums, and Exploit. An XSS post, from January 8, 2025, posted in both Russian and English displays a user looking to collaborate with other cyber criminals who are experienced with Romance Scams, stating “I am currently seeking reliable and experienced individuals who are actively working in this field [romance scams]. I have access to several clients and opportunities that could be mutually beneficial for collaboration.”:
A user on the popular hacking forum, CryptBB, alleged an effective way to become a fraudsters is pig butchering scams because it involves methods like crypto swifting. Crypto-swifting generally refers to the use of cryptocurrencies for cross-border money transfers, inspired by the SWIFT (Society for Worldwide Interbank Financial Telecommunication) system, which is widely used by traditional banks to send secure international financial transactions. The idea is to use cryptocurrencies and blockchain to enable real-time, low-cost, and secure global transactions without relying on central banks or legacy systems.
How are Romance Scams Mentioned on Telegram?
Romance Scams are often advertised as one of several fraud services by cybercriminals on Telegram channels. The following screenshot was taken from a popular Telegram Fraud Marketplace.
Another example that highlights romance scams services came from a credit card fraud Telegram market. This user also advertised various services, including PII associated with various dating sites that social engineers can leverage for Romance Scams:
What is E-Whoring and How Does it Relate to Romance Scams?
According to a recent University of Cambridge study, “eWhoring is the term used by offenders to refer to a social engineering technique where they imitate partners in virtual sexual encounters, asking victims for money in exchange for pictures, videos or even sexual-related conversations (also known as sexting). Packs of multiple images and videos of the people being imitated are traded on underground forums. This material is used as the bait to entice victims into paying for online encounters. Underground forums serve as a place for the interchange of knowledge and new techniques to improve the benefits obtained from this illicit business”
Cyber criminals take great pride in proving themselves by sharing their knowledge, tips and tricks with others to build up their reputation and standing out within the threat actor community. DarkOwl analysts observed many sharing, some for free and some for sale, guides and ebooks covering how to get involved in e-whoring and romance scams.
DarkOwl analyst discovered recent comments on a post on the popular hacking forum, BreachForums, where a user advertised a large e-whore database allegedly containing over 637 GB.
E-whoring packs are also commonly sold across darknet markets, forums, and cybercrime related Telegram channels and Discord servers. The following post from the notable carding fraud forum, Craxpro, advertised a leaked database for an OnlyFans model:
E-whoring packs and databases are the most common, however, we also discovered an e-whoring bot being sold on Craxpro for 10,000 USD per month:
We also identified Telegram users selling access to e-whoring mentorship services. The below user advertised e-whoring mentorship service for 350 USD and accepts LTC, BTC, ETH, PPl, and Wise.
Conclusion
Romance scams, how they identify their targets, and e-whoring a will remain popular topics across the darknet as long as this form of fraud remains profitable, effective, and efficient form. One of the examples claimed that romance scams are the gateway to becoming an experienced fraudster that dabbles in its various forms. We also observed a large supply of users selling this fraud knowledge and a large demand of eager “newb” fraudsters willing to pay for this knowledge.
Darknet actors will continue to innovate as long as it remains profitable. As with conducting any activity on the internet, it is always important to remain vigilant to scams, whether that be romance scams or not.
DarkOwl wanted to share a few steps recommended by the FBI in order to protect yourself again romance scams.
Protect Yourself
- Be careful what you post and make public online. Scammers can use details shared on social media and dating sites to better understand and target you.
- Research the person’s photo and profile using online searches to see if the image, name, or details have been used elsewhere.
- Go slowly and ask lots of questions.
- Beware if the individual seems too perfect or quickly asks you to leave a dating service or social media site to communicate directly.
- Beware if the individual attempts to isolate you from friends and family or requests inappropriate photos or financial information that could later be used to extort you.
- Beware if the individual promises to meet in person but then always comes up with an excuse because he or she can’t. If you haven’t met the person after a few months, for whatever reason, you have good reason to be suspicious.
- Never send money to anyone you have only communicated with online or by phone.
We wish all our readers a very happy and safe Valentine’s Day!
Don’t miss anything from the DarkOwl analyst team! Subscribe to email.
The post Valentine’s Day: A Celebration of Love or a Trap for the Vulnerable? appeared first on DarkOwl, LLC.