Title: 2 New Fake Chipmixer website Post by: Yaunfitda on May 14, 2020, 08:34:01 AM (1) Take notice of the ẹ. Another type of homograph attack. Just created more than two weeks ago. Code: chipmixẹr.com - https://xn--chipmixr-z30d.com/ https://i.imgur.com/aptKgCN.png Quote Registrar NAMECHEAP INC NameCheap, Inc. IANA ID: 1068 URL: http://www.namecheap.com Whois Server: whois.namecheap.com (p) Registrar Status addPeriod, clientTransferProhibited Dates 18 days old Created on 2020-04-26 Expires on 2021-04-26 Updated on 0000-12-31 http://whois.domaintools.com/xn--chipmixr-z30d.com (2) This one is a classic Typosquatting, or URL hijacking. Also this is created around two weeks ago. Notice the S. Code: https://chipmixers.io/ https://i.imgur.com/FCQyiLW.png Quote Registrar Namesilo, LLC IANA ID: 1479 URL: http://www.namesilo.com Whois Server: whois.namesilo.com (p) Registrar Status clientTransferProhibited, serverTransferProhibited Dates 15 days old Created on 2020-04-29 Expires on 2021-04-29 Updated on 2020-04-29 http://whois.domaintools.com/chipmixers.io Title: Re: 2 New Fake Chipmixer website Post by: GreatArkansas on May 14, 2020, 09:01:09 AM ChipMixer should be aware of this. It's really amazing how scammers can easily copy the original website. I also saw some fake Bitcoin mixers website before especially around bull run 2017.
Better if we also report these domains to their registrar or domain provider, abuse@namecheap.com and abuse@namesilo.com Title: Re: 2 New Fake Chipmixer website Post by: Maus0728 on May 14, 2020, 09:06:19 AM I wonder why there are always multiple phishing website that has similar fancy characters like this! "ẹ". Similarly, the other thread created by has also a similar fancy character in their URL in creating fake Ledger website.
I think these are created by the same person or group of person! Anyways, link for reporting phishing link. https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en phishing-report@us-cert.gov - email the link here! Title: Re: 2 New Fake Chipmixer website Post by: DdmrDdmr on May 14, 2020, 10:09:49 AM I wonder why there are always multiple phishing website that has similar fancy characters like this! "ẹ". <…> Simply in order to make the URL name as close as possible to the original one they are trying to mimic. A little dot (as is the visual appearance) is a minor difference that may go unnoticed (who’s got a perfectly clean screen without any smudges on it?), and that is what the phishing site is counting on. Other classical spins are skipping or adding a letter, or permuting a couple of them. All these tricks are detectable if one is paying close attention, but not fast to spot when in a rush, or the site is not a regular site and one is landing there for the first time. Title: Re: 2 New Fake Chipmixer website Post by: BITCOIN4X on May 14, 2020, 10:13:44 AM Code: https://chipmixer.com/ Quote Registrar Status, clientTransfer Prohibited Dates 1,407 days old Created on 2016-07-07 Expires on 2025-07-07 Updated on 2019-12-11 This is the original chipmixer site and I just want to get the difference because I didnt get the information on the OP. Please add the original site and the details too for comparison, great for readers. ~snip My guess is that they dont work alone and its like a group of people who are really crazy about other peoples possessions.Title: Re: 2 New Fake Chipmixer website Post by: BitcoinGirl.Club on May 14, 2020, 11:39:27 AM https://talkimg.com/images/2023/05/14/blob5cde194a71e63263.png
This is very frustrating for me. All those days, I used to think that homograph attack can be caught using copy paste but with this ẹ, it seems there no difference with the original e. 🤔 Try yourself with Ctrl+F and then type e you will see both are highlighted below. e : English letter ẹ : homograph letter Title: Re: 2 New Fake Chipmixer website Post by: btc_angela on May 14, 2020, 11:52:30 AM I wonder why there are always multiple phishing website that has similar fancy characters like this! "ẹ". Similarly, the other thread created by has also a similar fancy character in their URL in creating fake Ledger website. I think these are created by the same person or group of person! Anyways, link for reporting phishing link. https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en phishing-report@us-cert.gov - email the link here! Probably those are created by one group of cyber criminals. And it's really hard to detect at first glance, and we can see that this is a sophisticated attack using Chipmixer. There is a wonderful tool to check for Punny code here. https://www.punycoder.com/ One way to able check on it is to click the padlock, -> certificate https://i.imgur.com/kkZZOgA.png Title: Re: 2 New Fake Chipmixer website Post by: boyptc on May 14, 2020, 01:40:20 PM I think I've seen a similar letter with other known exchanges like Binance. That special character is being used by these abusers to fake websites that has letter e on its domain.
Title: Re: 2 New Fake Chipmixer website Post by: Velkro on May 14, 2020, 02:03:22 PM This is the original chipmixer site and I just want to get the difference because I didnt get the information on the OP. Please add the original site and the details too for comparison, great for readers. Agree here, adding original site for comparision is good thing to do.My guess is that they dont work alone and its like a group of people who are really crazy about other peoples possessions. If someone posess such skills, copying over and over his fake website with different domain names isnt that hard. Phishing is one of main scam techniques in world wide web since forever :P. You can't eliminate them, there are so much of them, so best thing to do is educate the public about it. Title: Re: 2 New Fake Chipmixer website Post by: Pffrt on May 14, 2020, 02:11:52 PM I think I've seen a similar letter with other known exchanges like Binance. That special character is being used by these abusers to fake websites that has letter e on its domain. Most of the phishing sites are based on homograph letter. You can change the i,a,e which looks same as the actual one and it makes easy to target even very smart trader with a lot of experience. It's an old school method of phishing.Title: Re: 2 New Fake Chipmixer website Post by: boyptc on May 14, 2020, 03:20:06 PM I think I've seen a similar letter with other known exchanges like Binance. That special character is being used by these abusers to fake websites that has letter e on its domain. Most of the phishing sites are based on homograph letter. You can change the i,a,e which looks same as the actual one and it makes easy to target even very smart trader with a lot of experience. It's an old school method of phishing.It's old as it is but the sad thing is that there's still plenty of victims they get. Title: Re: 2 New Fake Chipmixer website Post by: Lucius on May 14, 2020, 03:58:39 PM Use link from post number 3 and report both link to Google, more reports will surely result in a quick reaction and both sites will be blocked in Chrome&Firefox which are the browsers with the most users these days. Another option is report them to registrar or domain provider, but from some personal experience it seems to me that they rarely react positively to such reports. Part of the responsibility is definitely on the hosting company, but as in the case of Google ads, it’s obvious that no one wants or can check things like this.
Title: Re: 2 New Fake Chipmixer website Post by: Baofeng on May 14, 2020, 10:47:16 PM Alternatively, you can report the abuse on the following:
(1) https://www.namesilo.com/report_abuse.php (2) https://support.namecheap.com/index.php?/Tickets/Submit Reported both of them. From Namecheap: Quote Your request has been received We have received your request and our team will get back to you shortly. You can log in to the helpdesk to review the status of your request, or check your email for further updates. General Information Ticket ID #PWA-170-71983 First and Last Name xxxx Email xxxx Type Issue Priority High From my experience reporting sites from both domain registrar, it usually took 2-3 before they take it offline. Crossing our fingers that no one will fall for this trick. Title: Re: 2 New Fake Chipmixer website Post by: Chikito on May 15, 2020, 12:00:45 AM Maybe try to subscribe dnstwister to avoid scam, see link below to know how much similar chipmixer domain.
https://dnstwister.report/search?ed=636869706d697865722e636f6d Quote We identified 324 domains similar to chipmixer.com. 60 domains resolved to an A or MX record https://i.postimg.cc/kghGMLND/g.png I find over 500+ on union https://dnstwister.report/search?ed=636869706d69786572777a78747a62772e6f6e696f6e Quote We identified 579 domains similar to chipmixerwzxtzbw.onion. No domains resolved to an A or MX record dns twisster will alarming you when new similar created. then report it. Title: Re: 2 New Fake Chipmixer website Post by: smyslov on May 15, 2020, 05:57:22 AM If you bookmarked the real Chipmixer site and you have a metacert extension or similar extension you are safe, not really surprising, it's one of the top mixing site in the business and hackers are making big bucks imitating or creating a phishing site.
Title: Re: 2 New Fake Chipmixer website Post by: Yaunfitda on May 18, 2020, 02:45:07 AM Quick Update:
The second website has been taken down already. But namecheap is slow to react, I urge everyone to help the community by reporting the first website to them. Title: Re: 2 New Fake Chipmixer website Post by: TalkStar on May 18, 2020, 03:40:57 AM The second website has been taken down already. That's great,,, I don’t know how many people have already lost their funds due to this kinda phishing sites but i am damn sure that these scammers will continue with another domain. But namecheap is slow to react, I urge everyone to help the community by reporting the first website to them. Title: Re: 2 New Fake Chipmixer website Post by: Jating on May 18, 2020, 10:36:58 AM Quick Update: The second website has been taken down already. But namecheap is slow to react, I urge everyone to help the community by reporting the first website to them. Reported the second site in my end. So let's see, namecheap is one of the biggest domain registrar out there so they might be a lot of reports for them to review, specially that there are a lot of cyber criminals taking this opportunity to create Covid-related themes so it might take some time. So let's just wait and see how it goes. Thanks for the fair warning again. Title: Re: 2 New Fake Chipmixer website Post by: cryptomaniac_xxx on May 18, 2020, 10:46:10 AM I've written a short guide on where to report those abuses here, Domain host and their abuse contact (https://bitcointalk.org/index.php?topic=5245615.0). So for those who are not familiar, you can refer to that thread.
|