Episode
02 January 2024 Official episode · Official transcript
cybercrime
The episode examines pig-butchering romance and cryptocurrency scams, business email compromise, Nigerian fraud networks, Black Axe, Scattered Canary, and pandemic-relief fraud.
Topics: Pig-butchering romance and cryptocurrency scams, Business email compromise, Social engineering and emotional manipulation, Cryptocurrency wallet transfers and fraudulent investment platforms, Credential phishing, Money muling and laundering, Lookalike domains and typosquatting, Levenshtein Distance for domain similarity, Domain registration-age analysis, Deepfakes and AI-assisted impersonation, Google dot bug, Pandemic unemployment and relief fraud, Black Axe and Nigerian cyber-fraud networks
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
pig butchering ASSOCIATED_WITH Sha Zhu Pan
Ronnie says the term “pig butchering” comes from the Chinese phrase Sha Zhu Pan; he is unsure of the exact translation.
Explicit Confidence 98% · Ronnie Tokazowski EP 141 Details
“the term ‘pig butchering’ comes from a Chinese phrase called Sha Zhu Pan”
pig butchering INVOLVES social engineering
The scam uses emotional manipulation and relationship-building to persuade victims to send money.
Explicit Confidence 99% · Jack Rhysider EP 141 Details
“they social-engineered him and tricked him into sending his crypto to the scammer’s wallet”
pig butchering INVOLVES crypto.com
The described scam made its fake investment application appear to operate within the legitimate crypto.com application.
Explicit Confidence 98% · Jack Rhysider EP 141 Details
“they made it look like it was using a legitimate exchange. In this case, crypto.com”
pig butchering INVOLVES WhatsApp
Scammers move dating-platform conversations to WhatsApp and use the channel to groom victims.
Explicit Confidence 98% · Ronnie Tokazowski EP 141 Details
“they’ll move you up to WhatsApp and then from there they’ll start grooming the person”
pig butchering INVOLVES deepfakes
Some pig-butchering scammers reportedly use deepfake or AI-generated video messages to make remote romantic identities appear credible.
Uncertain Confidence 92% · Ronnie Tokazowski EP 141 Details
“some scammers are using that technology in order to generate video messages back and forth”
Ronnie Tokazowski USES Business E-mail Compromise
Ronnie says he has spent eight years fighting business e-mail compromise.
Explicit Confidence 99% · Ronnie Tokazowski EP 141 Details
“I’ve been fighting business e-mail compromise for the last eight years now”
Ronnie Tokazowski ASSOCIATED_WITH United States Secret Service
Ronnie says he works with the Secret Service while assisting romance-scam victims.
Explicit Confidence 99% · Ronnie Tokazowski EP 141 Details
“I do a lot of work with Secret Service, FBI”
Ronnie Tokazowski ASSOCIATED_WITH Federal Bureau of Investigation
Ronnie says he works with the FBI while assisting romance-scam victims.
Explicit Confidence 99% · Ronnie Tokazowski EP 141 Details
“I do a lot of work with Secret Service, FBI”
Business E-mail Compromise USES Credential phishing
Ronnie says that, in some BEC cases, attackers harvest e-mail credentials and passwords through credential phishing.
Explicit Confidence 97% · Ronnie Tokazowski EP 141 Details
“At most they will do credential phishing where they’ll try and harvest the e-mail credentials and e-mail passwords”
Business E-mail Compromise ASSOCIATED_WITH phishing
Ronnie describes phishing as the overarching term for e-mail-based threats, while distinguishing it from financially motivated BEC.
Explicit Confidence 96% · Ronnie Tokazowski EP 141 Details
“phishing is kind of the overarching term for any e-mail-based threat like that”
Business E-mail Compromise USES typosquatting
BEC operators may register a domain one letter away from a legitimate business domain to impersonate a trusted party.
Explicit Confidence 97% · Jack Rhysider EP 141 Details
“register a domain that’s one letter off from the real one”
Black Axe USES Business E-mail Compromise
Ronnie says BEC activity is tied, from an attribution perspective, to groups such as Black Axe.
Attributed Confidence 88% · Ronnie Tokazowski EP 141 Details
“from an attribution perspective, this ties back to groups such as Black Axe”
Black Axe ASSOCIATED_WITH Neo Black Movement of Africa
The episode presents Black Axe and the Neo Black Movement of Africa as possibly overlapping identities, while also noting that NBM representatives deny the connection.
Uncertain Confidence 91% · Host2 EP 141 Details
“many people use the names Black Axe and NBM interchangeably”
“NBM is not Black Axe. NBM has nothing to do with criminality”
Yahoo Boy USES Yahoo Messenger
Jack says Yahoo Boys received their name because they initially used Yahoo Messenger to conduct scams.
Explicit Confidence 97% · Jack Rhysider EP 141 Details
“they started out using Yahoo Messenger to conduct their scams over”
Scattered Canary USES Business E-mail Compromise
Ronnie identifies Scattered Canary as a mostly Nigerian cyber-fraud group engaging in BEC since 2018.
Explicit Confidence 99% · Ronnie Tokazowski EP 141 Details
“Scattered Canary was a mostly-Nigerian cyber-fraud group that we found back in 2018 that was engaging in business e-mail compromise”
Scattered Canary EXPLOITS Google dot bug
Scattered Canary used e-mail accounts affected by the Google dot bug when targeting unemployment-fraud systems.
Explicit Confidence 98% · Ronnie Tokazowski EP 141 Details
“they used different e-mail accounts or e-mail accounts that had the Google dot bug in them”
Scattered Canary USES romance scam
Ronnie says Scattered Canary was involved in romance scams as well as BEC and unemployment fraud.
Explicit Direction flagged Confidence 98% · Ronnie Tokazowski EP 141 Details
“we know they were doing romance scams. We know they were doing unemployment fraud”
romance scam INVOLVES money muling
Romance-scam victims can be used as money mules to receive and wire funds for BEC scams.
Explicit Confidence 99% · Ronnie Tokazowski EP 141 Details
“they will use those romance scam victims as a money-muling network to send money for these scams”
Business E-mail Compromise ASSOCIATED_WITH 419 scams
Ronnie says BEC was not a new crime but developed from or was connected to the same actors behind Nigerian 419 scams.
Explicit Confidence 95% · Ronnie Tokazowski EP 141 Details
“the scammers behind business e-mail compromise are the same people who have been doing these Nigerian prince scams for years”
Jack Rhysider REFERENCES Rolling Stone article on pandemic fraud
Jack says he is reading a Rolling Stone article about pandemic-fraud losses.
Explicit Confidence 99% · Jack Rhysider EP 141 Details
“this Rolling Stone article I’m reading right now says it’s more like $1 trillion was stolen”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T08:05:56.211905+00:00