Skip to main content

One of the biggest websites in the UK is fueled by criminal activity

A screenshot of the landing page (Image credit: Future)

A malware campaign is behind the meteoric growth of one of the biggest websites in the UK, research has suggested. Bitcoinnewstoday(dot)me is already labelled as a "dangerous website" by most search engines and trying to access it will bring up a bright red page on most.

Users of Microsoft Edge, for example, will see a warning that, "Microsoft recommends you don’t continue to this site. It has been reported to Microsoft for containing misleading content that could lead you to lose personal info, financial data, and even money."

Yet, according to website analytics company Similarweb, the site experienced a massive growth globally in May 2020, growing by a staggering 320x to reach 23rd place in its UK readership leaderboard.

With almost 76 million monthly visits (and 51 million unique visitors) during the month, it is bigger than far more prominent websites like Paypal, Argos or Linkedin. A closer analysis of the site reveals that it has a global rank of 784 and nearly 96% of the visits occurred via mobile.

Worryingly, most apparently spent more than 40 minutes on the page visiting on average 1.37 pages. In other words, most visitors were stuck on page one for a long, very long time.


In a statement to TechRadar Pro, a spokesperson for Avira Protection Lab told us that the site could be what security expert call a "rotator". These forward unwitting visitors to a random advertisement, and more recently, pages that cover fake crypto-exchanges (aka a bitcoin scam).

The page appears to be part of a wider network, with the domain name registered in November 2019 in Russia using dummy data. The site has been active since December 2019, with traffic disappearing in April 2020 and surging back in May.

Fake registrant data was used, which is often a common tactic for malware, phishing or scam domains. The web hosting of the site is likely to be located in Germany.

Avira added: "Refer selection is done via geo-location, so you get a different page if you are in the UK compared to France. They have partner pages for pretty much all European countries such as the UK, Germany/Austria/Switzerland, Spain, France, Sweden, Romania and even smaller ones such as Lithuania. They don’t seem to have pages for anything outside Europe, e.g. connecting with a Russian or Japanese IP just forwards you to e.g. the UK pages, while trying to connect with an US IP results in a forward to Funnily enough, Italian IPs also get redirected to"

"Sadly there are dozens of these out there, and often they don’t exist very long especially if they are getting flagged."

Desire Athow

Managing Editor, TechRadar Pro

Désiré has been musing and writing about technology during a career spanning four decades. He dabbled in website building and web hosting when DHTML and frames were en vogue and started writing about the impact of technology on society just before the start of the Y2K hysteria at the turn of the last millennium. Then followed a weekly tech column in a local business magazine in Mauritius, a late night tech radio programme called Clicplus and a freelancing gig at the now-defunct, Theinquirer, with the legendary Mike Magee as mentor. Following an eight-year stint at where he discovered the joys of global techfests, Désiré now heads up TechRadar Pro. He has an affinity for anything hardware and staunchly refuses to stop writing reviews of obscure products or cover niche B2B software-as-a-service providers.