# Scareware and Investment Scams Injected Into Real Sites

Injected scam and scareware content that steals attention and trust rather than card numbers, which is exactly why it survives on a page longer than a skimmer would.

Provenance: Observed in Report URI report telemetry.
Published: 2026-07-15. Updated: 2026-08-24.

Client-side security discussion is dominated by card skimming, because that is where the direct
financial loss is. It is not the only thing that gets injected into a compromised page, and the rest
is worth attention for a reason that has nothing to do with what it steals.

The hosts we track here serve scams. One is a fake-antivirus scareware CDN whose only asset is a
banner script impersonating a well-known security vendor, on a month-old domain fronted by a CDN
whose apex returns 403 to anyone looking. Another is an AI-trading investment scam that asks for a
deposit to get started, and is one node in a farm of clones across several top-level domains and
languages.

We found both in customer CSP violation reports and confirmed them from public sources.

## The point is not what they take

A skimmer converts a compromise directly into card numbers. A scam overlay converts it into the
visitor's attention while they are on a site they trust — the padlock, the domain and the brand are
all yours and all correct, which is exactly what makes the scam work better there than on a domain
the attacker registered.

The visitor does not distinguish. They saw a virus warning, or an investment offer, on your site.

## Why they last

A skimmer discovered on a checkout page produces an incident. A fake antivirus banner produces a
support ticket about a dodgy ad, and gets routed to whoever handles advertising.

That routing is the problem. Nobody looks at how the content got onto the page, so the injection
stays open. The next thing to arrive through it might be a skimmer, and by then the compromise has
been in place for months with a plausible explanation attached to it.

Treating an unexplained third-party host as a compromise regardless of what it serves is the
difference between finding this in July and finding out in December.

## A clone farm is one campaign

The investment-scam host we track is not a single site. The same operation runs the same content
across multiple top-level domains, with hyphenated variants and localised versions for different
languages.

That shape matters for how you respond. Blocking the one host in your reports stops that node and
nothing else, and the operator has more. It is the injection point on your own page that is worth
your time; the domain is the part they can replace cheaply.

## What to look for

An unfamiliar host in your reports on a page with no advertising and no third-party interface is the
signal, whatever it turns out to be serving.

Two things make these easy to miss. The volume is usually low, because campaigns are often
geo-targeted or shown to a fraction of visitors, so the reports arrive as a trickle rather than a
spike. And the host frequently sits behind a large CDN, so a reverse lookup tells you nothing useful
and the domain itself may refuse to answer anyone who goes looking.

## Indicators

- cdn.redgarto.com
- ryplonsyncgpt.com
- www.ryplonsyncgpt.com

## Questions

### Why does a scam overlay matter if no card data is taken?

Because it runs on your domain, under your certificate, with your name above it. The visitor was on your site when it happened, and that is what they will remember. It is also the same injection route a skimmer would use, so it tells you something is wrong on the page.

### How is this different from a Magecart skimmer?

A skimmer is silent and wants your checkout. This is loud and wants the visitor's attention, so it appears on any page rather than the payment flow. The technique that got it there is the same.

### Why do these last longer than skimmers?

They get reported as an ad problem or a rendering bug rather than a security incident. Nobody looks at the injection, so the underlying compromise stays open, and whatever comes next arrives through the same door.

### How would I see this in my reports?

As an unfamiliar host in your CSP reports on pages with no advertising and no third-party UI. Volume is often low, because these campaigns are frequently geo-targeted or shown to a fraction of visitors.