Between July 1 and Oct. 27, Netcraft’s analysts logged 121 newly registered domains containing the word “cyberleek”, the name attached to an anonymous leaker who began posting apparent Grand Theft Auto VI footage on Aug. 18. A hundred of those registrations landed in August alone. Some are fan pages, merchandise shops or memecoin projects, but the report documents plenty of others chasing the same audience: people eager to play a game that arrives on Nov. 19.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The lures are cheap to build and require no working software, which is why a tiny team can stand up dozens of near-identical pages in a week and wait for search traffic and social shares to do the rest. Rockstar has announced GTA VI only for PlayStation 5 and Xbox Series X|S, with no early release and no mobile edition, so every site promising a playable build before launch is making something up.
Cyberleek domains and the Aug. 18 leak
The research comes from a Netcraft report written by Gina Chow and Austin Anderson, published on Nov. 3. The team reviewed GTA VI-themed domains first seen in that July-to-October window, recorded what each page displayed and asked for, and deliberately did not pay, finish offers or connect a crypto wallet. Netcraft cautions that a wallet prompt is evidence of a risky lure, not proof that a site drains wallets, and that a site’s status can change within hours.
Help Net Security’s coverage picked out the key figures: 121 domains, 100 of them registered in August. The count therefore measures opportunism around a news event more than confirmed fraud, and that is why Netcraft treats the number as a map of lures rather than a tally of victims.
Five kinds of GTA VI bait
Netcraft sorted the sites into groups. Fake leaked-build downloads trade on the CyberLeek story and often demand a launcher or a crypto payment. One executable named GTAVI.exe, offered from a cyberleek domain, was flagged by 34 of 68 VirusTotal engines, mostly as a trojan, and a separate “Cyberleek Launcher” drew detections from 18 of 62. A launcher-delivered account asked for $100 in crypto to activate, while another site wanted 50 Tether or Bitcoin for an “early game build.”
False early-access and preorder pages form the second group, including sites that imitate Rockstar’s own branding and one asking $199 for a claimed game key. A fake preorder shop claimed a $10 per-order charity donation. The third group offers nonexistent mobile versions: “GTA 6 APK” sites that tell visitors to allow installs from unknown sources, or pop-ups labeled human verification that collect email addresses and other personal details. Netcraft downloaded one APK and found it clean, but stressed that no mobile version has been announced.
Giveaway pages make up the fourth group, with invented counters such as 43 of 300 codes remaining and 3,490 active users, promising anything from a $500,000 in-game payout to GTA Online currency tiers running from GTA$250,000 to GTA$10 million. The fifth group is content lockers, where a promised key stays hidden behind surveys and offers that earn the site operator affiliate revenue. As Netcraft put it, these sites do not need to deliver convincing software to make money.
After launch, the lures shift to in-game gains
Netcraft expects the bait to change once the game ships, moving from get the game to get ahead in the game. The analysts predict fake GTA$ and Shark Card offers, credential phishing aimed at Rockstar, Microsoft and Sony accounts, counterfeit support sites, and cheats or mod menus that may carry malware.
The launch date itself is not in dispute, and that certainty is what makes the fakes easy to spot for anyone who checks. PCWorld reported that Take-Two Interactive, Rockstar’s parent, confirmed Nov. 19, with chief executive Strauss Zelnick citing the Nov. 19 release as the lead event of its schedule. A PC edition is expected later, perhaps in 2027, which leaves the PC download pages as the most obvious fakes: no sanctioned PC build exists to download.
Fake game installers are an old pattern. Bitdefender’s Silviu Stahie described how malware hides in demos, early-access builds and mods, citing a 2025 Steam platformer that later added a drainer which stole more than $150,000 in crypto. His warning signs match the GTA VI pages: off-platform download links, pressure tactics such as limited-time offers, and studios with no real presence.
Netcraft’s advice is plain. Compare any offer with the official release details, buy only through the PlayStation or Xbox stores, and avoid sideloaded files, unrelated launchers, crypto payment to activate a game and prompts to connect a wallet. Reused passwords turn one careless click into several breaches. If a click already happened, the Federal Trade Commission’s phishing guidance says to update security software and run a scan, and to report the attempt at ReportFraud.ftc.gov. Netcraft has not published how many of the 121 domains are fraudulent, which leaves the registration count and the true scam total as different numbers.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
