A new fake investment site with the domain storcrystalld.top is currently running an active advertising campaign among Greek-speaking Facebook users, exploiting the names of Babis Papadimitriou, Christos Megalou, Yiannis Stournaras and SKAI. The page appears as an exclusive “deleted show” of “Kalimera Ellada”, aiming to mislead viewers and lead them to an unregulated “artificial intelligence” platform called Kerdanos. The SecNews technical team examined the mechanism and the signs that undoubtedly classify it as an organized Meta ads investment scam.
The ad URL includes parameters utm_source=fb, pixel_fb, token_fb and fbclid, which confirm that this is a paid promotion through Meta Ads Manager. The campaign name 1808 greec old 1000/70 abm car lm grtok betrays targeted targeting to an older Greek audience (old), with a budget of 1000/70 per day. A similar pattern has been identified by Bitdefender in a recent analysis of a global network of Meta ad scams that is spreading across twelve countries.
See also: Suspect arrested for global crypto fraud — Arrests also in Greece
The staged "television confrontation"
The fake site opens with a fake SKAI logo and the title “Good morning Greece | Exclusive”. The page claims that during a live broadcast, journalist Babis Papadimitriou exposed Eurobank CEO Christos Megalou for secretly using an AI investment platform. The episode was “deleted within six hours after calls from the banking sector”, according to the page. It features long, fictional dialogues with slangy rhymes, with Megalou saying “tighten your seatbelts” and Papadimitriou responding “It’s a TRAP”.
Nowhere on the official SKAI website, on Eurobank websites, or in actual TV broadcast archives is there any trace of such a confrontation. The invocation of “deletion” is typically used to discourage the reader from independent verification — if they cannot find the video, it has “logically” been removed due to the revelation. This is an internationally recognizable pattern of investment fraud that Bitdefender calls the “banker mic-drop” narrative.
The promoted platform "Kerdanos"
The bottom of the page leads to a platform called Kerdanos, which is presented as “investment AI that bankers want to hide.” The alleged offer includes a minimum deposit of €250, “withdrawals within 24 hours” through Alpha Bank, Eurobank, Ethniki and Piraeus, as well as promises of monthly profits from €700 to €1,800. The page cites stories of supposedly real users — a 42-year-old electrician from Thessaloniki, a teacher from Larissa, a firefighter from Heraklion — with details that give the impression of authenticity. None of the testimonials are verified.
Registration requires a name, email and phone number, with a statement that “an official representative will call for activation”. This is the crucial point: the call is not procedural, but the core of the scam. An alleged “advisor” pressures the victim to deposit €250, then convinces them to increase the amount through virtual winnings on the dashboard, and finally tries to gain remote access to the victim’s PC or e-banking credentials. The method is known as a “recovery room” or “investment boiler room” and is systematically applied by organized crime rings in the Balkans and Eastern Europe.
Related: Europol: "Strike" in online fraud ring — Victims also in Greece
Technical details of the fake site
The domain storcrystalld.top is served by Cloudflare (nameservers clay.ns.cloudflare.com and alice.ns.cloudflare.com) and terminates at a Caddy reverse proxy. The choice of the .top is not accidental: according to Cloudflare’s email security data, .top, .shop, .store and .xyz are consistently at the top of the TLDs associated with spam and malicious activity. Malwarebytes recently mapped a network of 20,000 fake shops with similar infrastructure, while the APWG documents a 300% increase in the use of these TLDs for phishing in the first quarter of 2026.
The exact same pattern — old show, bank executive, unregulated “AI platform” — has been recorded in Romania (livanago.pro), France (chertpostup.com), Italy (logicaquiferup.info), Belgium, and Poland. The perpetrators run the same playbook with localized brands and personas, share pixels and token IDs, and recycle domains every two to three weeks before the community reports them.
What's missing from the page — and why it matters
No page on the site displays the legal name of the company, the license number from the Capital Market Commission, the capital risk statement, the Terms of Use, the Privacy Policy or contact information beyond a web form. Every legitimate investment platform operating in Greece is required by MiFID II and national law to publish its registered office, regulatory authority, license number and a clear risk warning. The absence of these elements alone is a red flag that is enough to avoid the page.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Furthermore, the invocation of “35,247 new Greek users in 24 hours”, the indication “214 people are following this page” and the reservation of a position “for 24 hours” are classic techniques of artificial scarcity. The statements attributed to public figures — Stournaras, Nikos Fili, an anonymous former Eurobank executive — are fictitious and constitute a possible insult to the personality of those mentioned.
The malicious URL from the Facebook ad — DO NOT VISIT IT
For documentation purposes, we are listing the ad URL in defanged form (with parentheses around the dots and replacing https with hxxps), so that it is visually recognizable without acting as a clickbait. We are not directing our readers to the malicious page and are not providing any SEO benefit to the scammers. The listing is done solely so that readers can recognize the same ad if it appears to them on Facebook.
⚠️ WARNING — MALWARE URL IN DEFANGED FORMAT:
hxxps://storcrystalld[.]top/click?key=6235a02961ba4e4a8442d1fa2ffe7688 &ad_id=120254146726220271 &adset_id=120254146724250271 &campaign_id=120254146723780271 &ad_name=1+—+Копия &campaign_name=1808+greec+old+1000/70+abm+car+lm+grtok &pixel_fb=1430989035615888 &utm_medium=paid&utm_source=fb &fbclid=IwY2xjawTxECVwZG9m…The full real URL is kept in the archive of the SecNews editorial team and will be shared with the Cybercrime Prosecution. The campaign name 1808 greec old 1000/70 abm car lm grtok reveals that the campaign started on August 18th targeting an elderly Greek audience (greec old). Note: the ad_name contains the Russian word “Копия” (copy), an indication that the scammers are likely operating from a Russian-speaking infrastructure and recycling creatives.
How is the user protected?
The editorial team of SecNews recommends the following immediate protection steps. First, do not fill out a form on a fake site with unknown TLDs (.top, .shop, .xyz, .info) when the page advertises “quick profits” or “deleted show”. Second, anyone who has already provided a phone number or email address should block any incoming calls from unknown numbers and should never accept the installation of a remote access application (AnyDesk, TeamViewer) from a person posing as an “investment advisor”.
Anyone who has deposited money should contact their bank immediately to freeze the card or reverse the transaction, and report the incident to the Hellenic Police's Cybercrime Division (telephone 11188) and the Capital Market Commission . The advertisement can be reported to the Facebook Ad Library from the advertisement itself with the three dots → "Report Ad" → "Fraud or scam". At the same time, it is advisable to inform older relatives and friends, as they are the main target group of this campaign.
The Meta ad investment scams phenomenon cost over 20 billion dollars worldwide in 2025 according to FBI IC3 data. The Greek version of storcrystalld.top is not an isolated case but part of a well-organized international circuit. The SecNews technical team will monitor the development of the campaign and will update with new domains of the same network that are detected on the Greek-speaking internet.
We thank SecNews reader Dimitrios Geralis for the immediate and accurate information regarding the scam website.
