The Attack: Customer Acquisition Theft

Juancito Sport is a licensed sportsbook in the Dominican Republic. Rather than deploying malware or credential-harvesting phishing forms, threat actors engineered an operation focused entirely on customer acquisition theft: intercepting high-intent bettors searching for Juancito Sport and redirecting them to rival offshore sportsbooks.

Bettors searching for Juancito Sport were routed through lookalike domains and rogue ads directly into competitor registration and deposit flows. The sportsbook had no visibility into this traffic diversion and no rapid-response mechanism to dismantle it.

While the campaign spanned eight distinct platform surfaces, 78% of the threat volume sat in two primary channels:

• Lookalike & Redirect Domains (48% / 11 assets): Typosquatted domains built as the high-volume redirect engine.

• Meta Ads & Facebook Pages (30% / 7 assets): Paid promotional campaigns and spoofed brand pages driving top-of-funnel discovery.

• Social & Messaging Profiles (17% / 4 assets): Fake support accounts across Telegram, YouTube, Instagram, and X distributing fraudulent bonus links.

• Malicious Deposit Wallet (4% / 1 asset): A crypto wallet address distributed across rogue channels to intercept direct deposits.

A brand monitoring only its primary web domain would have missed more than half of the infrastructure siphoning away its players and marketing investment.

The Solution: Rapid Multi-Platform Enforcement

A ChainPatrol gap report flagged the network, revealing 10x more impersonations than Juancito Sport knew existed. ChainPatrol immediately executed an end-to-end takedown strategy:

1. 100% Domain Elimination

ChainPatrol identified 11 typosquatted redirect domains, including juancito-sportrd.com, juancitosportrd.com, and juancito-sport.com, all running active 301/302 redirects to competitor sites.

• Automated evidence dossiers and legal notices were dispatched directly to hosting providers and registrars.

• Priority redirect domains were offline in under 24 hours.

• Fastest resolution: 13 hours.

• Continuous liveness monitoring was deployed to intercept any re-registration attempts.

2. Terminating Paid Ad Exploitation & Social Impersonation

Attackers were running paid Meta ads from spoofed Facebook pages using Juancito Sport’s official promotional creatives to siphon deposit traffic.

• ChainPatrol filed brand and trademark enforcement notices through Meta’s verified rights-holder channels, terminating unauthorized ad campaigns and submitting spoofed pages for removal.

• Impersonation channels and support bots across Telegram, YouTube, Instagram, and X were escalated for platform-level suspension.

3. Neutralizing the Deposit Interception Wallet

Because blockchain addresses cannot be removed from decentralized ledgers, ChainPatrol pushed the malicious wallet address to its real-time blocklist network.

• Distributed across partner web3 wallets and browser integrations (including MetaMask and Phantom).

• Users attempting to transfer funds to the rogue address received immediate blocking warnings before transactions could confirm.

Key Results