Alongside the NCA, DOJ, FBI, Meta, and partners across 10 countries, Silent Push mapped adversary infrastructure behind West African scam centers during Joint Disruption Week in London.
Every scam center requires digital infrastructure to operate: domains, hosting, and a steady stream of fresh accounts to scam new victims in various ways. Such operations can quickly go dark when a massive-scale, collaborative law enforcement effort disrupts those components.
That principle drove Silent Push’s role in Joint Disruption Week, a coordinated international operation called Operation Blackout, aimed at criminal scam networks operating out of West Africa. Hosted by the UK’s National Crime Agency (NCA) in London, the effort brought law enforcement and private industry together to share intelligence in real time and act on it.
This operation led to a significant number of positive results, including the complete disruption of multiple fraud and scam centers, assets identified to freeze, identification of the operators across multiple African countries with subsequent arrests, and most importantly, the rescue of over 100 people trafficked against their will to work in fraud and scam centers successfully identified and located.
How Silent Push Contributed to Operation Blackout: Infrastructure Identification and Mapping
We supported the operation with what we do best: infrastructure identification, tracking changes to that infrastructure, and correlating across specific activity and linkages observed for a complete picture of the digital infrastructure that keeps fraud and scam center operations running.
Our team mapped the domains, hosting, and even the communication channels these networks depend on, then paired that mapping with attribution analysis to trace activity back to physical locations and the people operating them.
We shared certain findings exclusively with law enforcement. Our additional results included:
- Silent Push identified and verified 37,041 financial crime domains detected over the past year
- The team built 70+ detection rules and mapped them to this criminal network’s patterns and processes.
- The recon work performed exposed 173 very high-risk critical infrastructure nodes.
- Silent Push identified 679 operator handles used across a variety of scam tactics.
- The team also shared 11 intelligence reports with partners involved in the operation.
This is what Indicators of Future Attack (IOFA®) demonstrate. Instead of waiting for a scam domain to show up in a victim complaint, we fingerprint the infrastructure patterns criminals rely on and flag new assets as they stand up. This gives law enforcement a map of where a network is going, not just where it has been.
A Global Coalition Built for Speed
The NCA hosted the operation in partnership with the U.S. Department of Justice, the FBI, and several U.S. federal agencies. Those included the DOJ’s Scam Center Strike Force, the U.S. Secret Service, the Department of the Treasury, Homeland Security Investigations, and the Homeland Security Task Force.
The group worked with Nigerian and Ghanaian authorities, INTERPOL, and law enforcement from Australia, Canada, India, and New Zealand. On the industry side, Silent Push joined Meta, Adobe, Binance, Chainalysis, Coinbase, Cyjax, Elliptic, Flashpoint, Google, Microsoft, OpenAI, Starlink, and TRM Labs. Meta played a central role in coordinating private sector participation.
The disruption culminated in a week of joint work in London, building on months of investigation that continues. Investigators and industry partners traded intelligence across platforms, jurisdictions, and financial systems, then moved against scam centers in Nigeria, Ghana, and neighboring countries. Many of those operations targeted victims in the United States and the United Kingdom.
The schemes ranged widely: cryptocurrency investment fraud, romance scams, fake job and task offers, law enforcement and military impersonation, “digital arrest” extortion, non-delivery fraud, and scam recovery schemes that target people who have already lost money once.
Real-World Results
The combined effort of law enforcement and industry partners produced measurable impact on the ground and online:
- 28 arrests. Law enforcement arrested 19 people in Sasaabi, a suburb of Accra, Ghana, and 9 more in Nigeria, according to the Department of Justice. Authorities also seized hundreds of electronic devices.
- 117 trafficking victims identified. People trafficked and forced to work in a Ghanaian scam compound were freed. DOJ reports they are now pending repatriation to Nigeria.
- 3.7 million+ accounts removed. Meta removed more than 3.7 million West Africa-based accounts, Pages, and Groups from Facebook and Instagram, many impersonating American and British users.
- 30+ scam center leads. Meta shared leads on more than 30 suspected scam centers with law enforcement.
- More than $11 million identified. Private sector partners identified more than $11 million in potentially freezable funds, according to DOJ.
No single organization could produce these results alone. Platform takedowns remove the accounts, financial tracing follows the money, and infrastructure intelligence reveals the backbone connecting it all.
Identifying infrastructure in the preparation phases is a weak point for many organizations. Disruption Week showed how preemptive cyber defense technology and fast collaboration can lead to arrests when industry and law enforcement work side by side.
What This Means for Defenders
For fraud and trust & safety teams: Stop chasing scams one complaint at a time. Map the domains and hosting behind the accounts you remove, and find the next wave before it reaches your users.
For financial institutions: Investment and romance scams end with transfers from your customers’ accounts. Feed infrastructure intelligence into your fraud controls so you can flag payments headed to known scam operations before the money leaves.
For threat intelligence teams: Treat scam networks like any other adversary. Fingerprint their infrastructure, build detection rules around their patterns, and share what you find. This operation proved that shared intelligence moves faster than any single team can.
For law enforcement partners: Infrastructure leads hold up. Attribution ties digital assets to physical locations and named operators, giving investigators something concrete to act on.
Exposing the Backbone
“Silent Push mapped more than 35,000 malicious domains, dedicated internet infrastructure, and nearly 700 communication channels tied to scam centers operating across Africa. By pairing that infrastructure mapping with attribution analysis, our team helped law enforcement trace these networks back to physical locations and the operators running them, which led directly to enforcement action on the ground. Scam centers depend on infrastructure to stay hidden. Exposing it is how you put them out of business.”
Michael Sweeney, Director, Preemptive Cyber Defense, Silent Push
Joint Disruption Week is one milestone in a long-game effort. Threat actors and their networks will adapt, but so will we. Taking down these criminals will continue to require a global effort, and Silent Push’s unique capabilities and intelligence will keep us in a pivotal role in bringing justice to victims and helping both the U.S. and U.K. governments notch these big wins.
See the Infrastructure Before It Strikes
Silent Push gives security, fraud, and intelligence teams the same preemptive visibility we brought to this operation. Talk to one of our experts to learn more about our platform and see it in action.
Sign up for the free Silent Push Community Edition and start exploring today.
