This blog post describes how I discovered a (currently inactive) Moroccan scam ring.

In 2021, I started looking for a short .com domain for a potential business in the future. After a lot searching I finally landed on cotyx.com that was available and only 5 letters long!

As any IT person would, I added it to M365 and didn’t think much more about it.

In 2024, to optimize my expenditure, and since I was closing my freelance company. I opted to host my emails on Proton Mail (not sponsored). Proton Mail has the ability for a catch-all address, so I set this up to get the most functionality out of the service.

Fast forward to 30 November 2024, I received an email on asia@cotyx.com regarding the Terms and Community standards update from Instagram. Weird, I never configured this myself? My first instinct was that this was phishing, but after a closer look, it was a legit email. So, like any curious IT technician, I reset the password and login to to investigate.

I start going through the messages, and see quite a few interesting things.

It seems they started their scam with a Shopify store on cotyx.com, where they would comment on people their posts to contact them for a collab. Once the person contacts them, they would share a link for their ambassador program and how they could get a 50% discount on their purchase to receive free products in the future. At first, I thought they were just dropshipping, something often done to steal money from the populace while adding no value. But as you can see further below, they did not even ship any products.

Some people managed to file fraud claims with their bank to get their money back.

But, others weren’t as lucky.

Some did notice it was a scam.

But no morals were to be found, as they even tried to scam a 13 year old girl.

After going through a few messages, I’ve noticed a group-chat between several scammer accounts.

And when we check the members, we can see that @advicetify is the admin of this group.

In some other chats, we can see that they’re sharing communication templates with each other.

But there is also a chat with the admin of the group I’ve shown earlier. Whenever a new order came in, the admin informed the person managing the account I seized. So it’s safe to assume that multiple people are involved in this operation, with @advicetify being the leader of the scam ring or at least having control of the Shopify stores and the money flowing in.

So, let’s take a closer look at the @advicetify account.

We can see that it has 2 URLs linked in the bio.

When checking the websites, we see 2 websites build with a similar template.

When we go to the bottom of prodtify.com, we can see that there is an ICE (Identifiant Commun de l’Entreprise) code which seems to be the business number of this company.

When we google this ICE code, we find another website with a similar looking template.

And it seems that these 3 sites are created by the same company.

When we scroll down a bit, we see the CEO of this company.

With a link to LinkedIn.

The curious part is, the @advicetify follows the @photographe_agadir account on Instagram, both of which are owned by Mohamed El khadir and even uses it to comment on his own posts.

And currently the following facts are certain, the scams originated from a town called Agadir in Morocco, and that Mohamed either knows our scammers, or is part of the scammers.

I’ve send an email to Mohamed asking for comments based on a screenshot of the conversation with the @advicetify account, and I’m currently pending a response.