Romance scam domains: what practitioners need to act on now

TL;DR: Romance-themed domain registrations are spiking ahead of Valentine’s Day, with Bfore reporting more than 3,280 suspicious domains, 1,762 .com registrations and a 280-domain DGA cluster already active. The pattern shows pre-positioned social engineering infrastructure, not isolated phishing noise, and it shifts the control problem toward early detection, takedown velocity and user trust boundaries.

Editorial analysis by NHI Mgmt Group, based on content published by Bfore: “Romance Scams Proliferate Domain Registrations Ahead of Valentine’s Day”.

By the numbers:

• Bfore analysed more than 3,280 suspicious domains containing romance-related strings such as love, valentine, dating, tinder and matchmaking.
• The campaign’s .com registrations totalled 1,762 domains, making that TLD the dominant credibility play in the dataset.

Key questions

Q: What control gap lets romance scams succeed before a victim even clicks?

A: The gap is weak visibility into the pre-contact layer.

Q: Why do romance scams often move victims into encrypted messaging apps?

A: Moving to encrypted messaging removes platform moderation, abuse reporting and reputation signals that can interrupt the scam.

Q: What are the signs that a romance scam is underway?

A: Common warning signs include unsolicited messages, rushed intimacy, requests to move to private channels, too-good-to-be-true offers, and links or downloads that were not expected.

Practitioner guidance

• Monitor seasonal domain bursts Track newly registered domains containing romance, dating, gift and matching keywords, especially when they appear in large clusters across a short time window.
• Escalate high-risk TLD combinations Flag theme-heavy registrations that combine trust cues with low-cost or app-like TLDs, because they often support disposable scam infrastructure.
• Treat channel migration as an abuse signal Add warnings and workflow checks when users are pushed from a dating or social platform into encrypted messaging for verification, investment or support.

Bottom line: Romance scam infrastructure now begins with large-scale, seasonal domain staging that creates trust before any victim interaction takes place.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →