[What happened:]

What happened:
Before I went to sleep last night, a thread with the word "retrieval" at the end of it caught my attention, but I was too tired to check it, so I just archived it... Today, I did some digging and it appears that it's one of those fake recovery services!

- At first glance, it appears as a legitimate one since it doesn't require an upfront fee, but they claim to "recover BTC from inaccessible wallets, scams, or accidental transactions" while also saying they have the ability to retrieve "ETH lost due to hacking, phishing"!

• _{There was also a mention of their own "software" and also "working in close collaboration with law enforcement"!}

- In addition to the above things, they're using stock photos for their team members:
e.g.

• Pavlo Fedor ^{[Founder & CEO]} = Neon portrait young attractive man studio stock photo
• Serhii Anatolii ^{[Marketing Manger]} = Jerom Bell ^{[scroll down (screenshot)]} from another website that might also be fake.

Scammers Profile Link:
Anthony125

Reference Link:
BEST WAYS TO STORE CRYPTO ^[archived]

• Archived version of CryptoRetrievalTools.com

Additional Notes:

cryptoretrievaltools@gmail.com
2301 Collins Ave, Miami Beach, FL 33139, USA

Domain name: cryptoretrievaltools.com
Creation Date: 2025-02-21T05:18:58.00Z

Tagged and "created a flag".

[What happened:]

What happened:
While I was browsing the Currency exchange board earlier, I noticed a new exchange is offering a huge $100 bonus for first-time swaps, so I checked and it turned out to be nothing but a phishing website that left clicking any of the buttons or tabs, would lead to a pop-up that asks you to "connect your wallet" and we already know what will be the outcome of that!

Cropped version ^{[click the above highlighted link for full screenshot]}:


Scammers Profile Link:
laywerswap

Reference Link:
LAYERSWAP ^[archived]

• It appears that due to "DDoS protection of Cloudflare", I can't properly archive their fake website.
• Original website: layerswap.io

Additional Notes:

Domain Name: layerswap.cc
Creation Date: 2025-01-01T19:36:13Z
Registrar Abuse Contact Email: abuse@namecheap.com
Registrar Abuse Contact Phone: +1.6613102107

Tagged and "created a flag".

[What happened:]

What happened:
This so-called recovery team is claiming they're capable of recovering lost funds from various types of scammers, but the reality is they're here to only collect more information so they can benefit from your future mistakes!

• Despite being only a few months old, the stats on their homepage show "15+ years in business with 50+ happy customers" while on their About Us page it shows "23+ years in business with 500+ happy customers"!
  
  
• Their address leads to a lot of other websites that are probably also fake ^{[e.g. here's one]}!
  
  
• Fake reviews from accounts that are using stock photos ^{[you can see two of them "in this screenshot"]}

Scammers Profile Link:
omarkareem012

Reference Link:
Introducing USDT-RecoveryPro: Your Trusted Partner in Cryptocurrency Recovery ^[archived]

• Archived version of their homepage
• Archived version of their About Us page

Domain name: usdt-recoverypro.com
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Creation Date: 2024-09-14T15:29:23.00Z
Registrar Abuse Contact Email: abuse@namecheap.com
Registrar Abuse Contact Phone: +1.9854014545

Code:

1234 5th Ave S, Seattle, WA 5678, United States.

Additional Notes:
I can probably find more things if I spend more time, but I don't think it's needed at this point.
Tagged and "created a flag".

[Note:]

Trezor
They're offering Model T for 40% off and Model One for 30% off.
^{- They also have discounts for their backup solutions (up to 50%) and bundles (up to 20%).}

Blockstream
50% off on the second Jade order.

Block
They're offering Bitkey for $99 and it'll last until the 29th of December.

OneKey
10% off on all of their products with code "XMAS-2024" ^{[it'll end on the 26th of December]}.

SecuX
They've slashed 50% on the price of Nifty while both W10 and W20 are 30% off ^{[these offers end in five days]}.

GridPlus
30% off for Lattice1 with code "Holiday24" and it'll last until 31st of December.

D'CENT
44% off on Biometric Wallet ^{[offer ends on January 5]}.

REAL security
They're offering 30% discounts on all of their models until 31st of December.

Ledger
They're giving different vouchers upon buying their products... $70 for Flex, $40 for Nano X and $30 for Nano S Plus.
^{- Credit goes to @OmegaStarScream.}

Ellipal
They're offering a $30 discount on Titan 2.0 and a $20 discount on Titan Mini ^{[the bundled versions have $60 and $49 discounts respectively]}.
^{- Credit goes to @Stalker22.}

Keystone
All of their products come with a 10% discount with code "2024XMAS" and it'll last until the 25th of December.
Note: Links to X posts or their official stores are hidden behind the highlighted words.

Please let me know if I've made a mistake or if I've missed any deals for this Christmas

[What happened::]

What happened::
This so-called exchange claims they're giving out 50 to 100 USDT to newly registered members on their platform, but despite saying the only requirement for enabling withdrawal is "a single buy/sell order", they're asking to either "connect our wallets or deposit 100$" and I think it's quite clear that both of these things will lead to them scamming their members!



Scammers Profile Link:
jerinracy

Reference Link:
New Exchange | free 50-100 USDT PROMOCODE ^[archived]
fix-trade.com ^[archived]

Additional Notes:

Domain name: fix-trade.com
Creation Date: 2024-11-19T07:35:38.00Z
Registrar Abuse Contact Email: abuse@namecheap.com
Registrar Abuse Contact Phone: +1.9854014545

Other fake platforms that use the same theme and template:

- bitcelix.com ^[archived]
- trustybin.com ^[archived]
- violcoin.com ^[archived]
Tagged and "created a flag".

[What happened:]

What happened:
While I was browsing the Service Announcements board earlier, I noticed there's a user who's claiming to be an Australian TV host... On top of that, he/she is promoting/labeling the website in the subject field as the "best crypto recovery company"!

• He/she didn't post the domain extension on the unedited version, but if we Google the first line, we can see this user has posted this spam in a lot of other places, and in one of them, he/she did it with adding extra spaces ^[archived]:
  
  

  Website; omegarecoveryspecialist .c om

  
  
  • They claim there's a "chargeback process" on the "Lost Bitcoin Wallet" tab while mentioning recovering funds through "SHA HASHING FUNCTION algorithm" on the "Wrong Address" tab ^{[referring to sent transactions]}: Archived link
  • Fake reviews with stock photos.
  • Their listed address belongs to an Italian restaurant in London ^[Isolabella] while they're using a number that belongs to the US ^{[North Dakota]}!

  • Checking on your website you claimed to be in this business for 22 years already but checking the information on your website it was just registered last year, a big discrepancy on what you are claiming.
    

Scammers Profile Link:
Kiamill111

Reference Link:
Best Cryptocurrency Recovery Company/Service ^{[archived - unedited version]}
- Archived version of OmegaRecoverySpecialist.com

Additional Notes:
Tagged and "created a flag".

[What happened::]

What happened::
While I was scrolling through the topics on the Lending board earlier, I noticed a user was asking for a 0.02BTC no collateral loan to withdraw his/her 41.90BTC on a newly created platform ^{[less than a month]} that doesn't allow adjusting the minimum withdrawal amount after the creation of their portfolio ^{[the whole story is obviously fake]}!

Scammers Profile Link:
xMillonx

Reference Link:
Need a 0.02 BTC 1 DAY LOAN ^[archived]
Gokoins.com <sup>[screenshot - I couldn't archive it properly due to its currency selection pop-up]
- Creation Date: 2023-12-14</sup>

• Other fake websites with the same template/theme:
  
  • Foretrademiningllc.cloud
  • Coinloaf.net

Additional Notes:
Tagged and "created a flag".

[What happened:]

What happened:
Earlier in the day, I was googling to see if I could find a new free TX accelerator ^{[in connection with "this thread"]} and it didn't take long before I landed on a fake one that was asking for our seed phrase while using a free GoDaddy website and based on how transaction fees are at the moment, I don't think it'd be the last of its kind ^{[unfotunately]}!

Reference Link:
https://bitcointransactionaccelerator.godaddysites.com ^{[archived version]}

Code:

https://bitcointransactionaccelerator.godaddysites.com

Additional Notes:
Please take a minute to also report it from here: AbuseReport

Update:
Alternative ways to report it:

• abuse contact email ^{[abuse@godaddy.com]}
  

• until then we can try with -> https://safebrowsing.google.com/safebrowsing/report_phish/
  

While I was searching for MCNs earlier, I stumbled upon a "post" that mentioned there's one that has Bitcoin as one of its payment methods: AIR Creators Ecosystem ^{[or Air Media-Tech]}

• I was wondering if anyone from here has any experience with them.
  ^{- It has a few mixed reviews on Trustpilot and Reddit, but there's no way of knowing which one is real or not!}
• If someone else ^{[preferably not newbies]} knows about another MCN that also pays with Bitcoin, please mention their name here.

[What happened:]

What happened:
While I was browsing the Goods board earlier, I noticed there's a user that claims his/her software can generate a ridiculous amount of Bitcoin and upon checking one of his/her other threads, it became worse!

Scammers Profile Link:
Bucksoftware101

Reference Link:
- Selling Bitcoin SmartGen – Premium Version 2023 - Exclusive Lifetime Access ^[archived]

• Bitcoin SmartGen is computer software for generating Bitcoin by exploiting flaws in the Bitcoin network. Integrated with a powerful hacking script, this software can generate up to 100 BTC per day on any type of wallet with a full 3/3 confirmation and you had the option of making your transaction completely anonymous. The RBF option as well as the setting of Proxy are also possible.
  
  I can help you setup the system through team viewer or you follow the video guide i'll add to the package. I give full refund if you do not get positive result.
  ~Snipped~
  

- Selling Meta Bitcoin Injector Software - 2023 Updated Version ^[archived]

• Meta Bitcoin Injector is a software that exploits the flaws of the bitcoin network using a powerful integrated computer script that allows it to generate a maximum of 300 Bitcoin per injection. It ensures a full confirmation of the transaction and generates the Bitcoin on any type of wallet and any type of addresses. The transaction can be completely anonymous. With this software, you can also generate Bitcoins on several cryptocurrency exchangers.
  ~Snipped~
  

Tagged and "created a flag".

Ayon sa sinabi ni Kenneth Stern ^{[general manager ng Binance PH]}, mukhang nakahanap na sila ng workaround sa pag kuha ng mga license dahil nasa final stages daw ang acquisition ^[source]. Since hindi nila binangit ang pangalan ng firm, we can only speculate...

• List of Virtual Asset Service Providers (VASP) [^{As of 30 June 2022]}
• List of Electronic Money Issuers (EMIs) ^{[As of 20 April 2022]}

List of firms with both licenses:

Code:

Zybi Tech, Inc.
WIBS PHP, Inc. (not operational)
TopJuan Technologies Corporation (not operational)
PDAX
Philbit Money Changer and Remittance Services, Inc. (PHILBIT)
PayMaya Philippines, Inc.
i-Remit, Inc. (not yet operational)

Anu masasabi niyo sa balitang ito? Personally sa tingin ko hindi parin titigil yung mga tao na nag complain dati...

[DON'T INSTALL THIS]

Trezor finally introduced an easier way for "normal users" to directly install the Bitcoin-only firmware in Trezor Suite!
^{Note: Bitcoin-only firmware existed "since 2019", but it was meant for advanced users.}

Steps for switching the firmware on Trezor Suite ^[v22.8.2]:

• Settings > Device tab > FIRMWARE > Type > Click Switch to Bitcoin > Install Firmware
  ^{Note: For those that use their hardware wallets for 2FA, "DON'T INSTALL THIS" Firmware!}

More information: Trezor Suite and firmware updates August 2022: Bitcoin-only firmware in Trezor Suite!

[What happened :]

What happened :
While I was browsing the Mining board, I noticed a new user with a couple of posts ^{[one of them is a newly created thread]} that clearly shows he/she is shilling for a specific website and when I looked closer, I noticed it's one of those Punycode attacks!
^{- It appears that they're taking advantage of the fact that the original website (previous archive) is currently down!}

Scammers Profile Link:
Innominer

Reference Link:
Latest posts of Innominer ^[archived]

• pangoıinminer.com/shop/ ^[archived]

Additional Notes:
If you go to their website and copy everything from the search bar and post it anywhere, it'll lead to the following result:

Code:

https://www.xn--pangoinminer-54b.com/shop/

Tagged and "created a flag".
Update:

Look who's back ^{[new account = Sirocco3]} promoting the "link in the subject field" after a short hiatus and it appears that he/she included another fake website in the mix as well...

Reference Link:
Latest posts of Sirocco3 ^[archived]

• miner.ebang.cn.com ^[archived] - I believe the original website is or was "miner.ebang.com.cn" instead!
  

Tagged and "created a flag".

[What happened:]

What happened:
While I was scrolling through topics in the Computer hardware section, I noticed there's a new branded account that's promoting a new platform, so I did some digging and found the following red flags:

• Fake reviews taken from other platforms ^[screenshot]
• Their "About Us" page, has plagiarized content ^[screenshot] from another platform ^[screenshot]
• At the bottom of the above page, they're claiming they made "2,648 successful deliveries with 10 being on each day" and that equates to being in operation for roughly 9 months, but they only registered their domain "two months ago"!
  
  • There are even a "bunch of blog posts" from last year!
• They pretend that almost all of their products are heavily discounted:
  
  • Shop (page 1)
  • Shop (page 2)

Scammers Profile Link:
Eurone Mining

Reference Link:
Buy Bitmain Antminer D7 ^[archived]
euronemining.com ^[archived]
Tagged and "created a flag".

[What happened:]

What happened:
While I was browsing the "Trezor's subreddit" page, I noticed there's a warning from a few days back, and since some of the users might not be frequent visitors of that page, I'm going to extend the warning here ^{[credit goes to @dpeacock93]}!

Reference Link:
- warning scam site
- Archived version of trez0r.io

Code:

trez0r.io

Additional Notes:
If you hover over some of the texts on the header and footer area, you'll see there's also another phishing website (archived version of trezoŗ.org)!
^{- Unfortunately, the main one is using NameCheap services, so it'd probably take a while to take it down [please take a minute to report them].}

Code:

trezoŗ.org

Domain name: trez0r.io
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Creation Date: 2022-06-21T16:14:34.03Z
Registrar Abuse Contact Email: abuse@namecheap.com
Registrar Abuse Contact Phone: +1.9854014545

Domain name: trezoŗ.org
Registrar WHOIS Server: whois.reg.com
Registrar URL: https://www.reg.com
Registrar URL: https://www.reg.ru
Creation Date: 2022-05-31T08:14:26Z
Registrar Abuse Contact Email: abuse@reg.ru
Registrar Abuse Contact Phone: +7.4955801111

[What happened:]

What happened:
As soon as I saw it's a self-moderated thread and they're using a URL shortener to hide their link, I knew something wasn't right! Based on the "trace result", it's safe to say that there's a connection between them and "Chainmine.io ^{[and "Prime-Coin.co"]}!

Scammers Profile Link:
RYX573

Reference Link:
Free 1 TH/s Bitcoin Mining Power For Lifetime/Monthly Profit: 0.00023 BTC ^[archived]

• ~Snipped~
  Link: tinyurl dot com/BTCTHS
  

btcoincloudmine.com ^[archived]

• [Expose] Chainmine.io Hype Project

Additional Notes:

• It already has a lot of bad reviews on "Trustpilot"!
  
  

• Domain Name: btcoincloudmine.com
  Registrar URL: https://www.namesilo.com/
  Creation Date: 2022-02-19T07:00:00Z

Tagged and "created a flag".

[What happened::]

What happened::
As soon as I saw the subject field on "this thread", I knew it was one of those sellers that pretends to have a mining rig that's not yet available in the market ^{[it'll be shipped starting "next month"]} and in addition to that, the second line in the thread in question, translates to: "On sale: buy 2 get 1 free as a discount."

Scammers Profile Link:
Jabrichimport

Reference Link:
New 2022 BITMAIN ANTMINER S19 Pro+ Hyd 198TH/s (WhatsApp : +6011-2302-4547) ^[archived]

• New 2022 BITMAIN ANTMINER S19 Pro+ Hyd 198TH/s
  
  En venta: compre 2 y obtenga 1 gratis como descuento.
  
  WhatsApp :     +6011-2302-4547
  ~Snipped~
  Email: Jabrichimportexporttrd@gmail.com
  

Tagged and "created a flag".

Mukhang may bagong player nanaman na papasok sa crypto field at kahit wala akong masyadong ideya tungkol sa kanila, it's still a good thing dahil it indirectly forces others to improve their services: PH Digital Bank Tonik on the Lookout for Crypto Partners

• May mga Tonik users ba dito? I'm curious to know kung reliable sila or not?

[What happened:]

What happened:
While I was looking for certain electrum-related information, I stumbled upon a blog that posts about electrum-related guides and tutorials ^{[all of those are probably plagiarized content]} and immediately redirects to a fake Electrum website!

Reference Link:
cryptoformacion.com ^{[because of the redirection part, I couldn't archive it, but this is its "screenshot"]}
get-electrum.com ^[archived]

• The latest release on the "official Electrum website" is 4.2.0, but on the above fake website it's 4.0.4!
• The verification parts are missing for both "Python sources" and "GPG signatures" sections!

Additional Notes:

Domain name: cryptoformacion.com
Creation Date: 2021-07-21T07:13:46.00Z
Registrar: NAMECHEAP INC
Registrar Abuse Contact Email: abuse@namecheap.com
Registrar Abuse Contact Phone: +1.9854014545

Domain Name: get-electrum.com
Creation Date: 2021-12-11T03:29:37Z
Registrar: GMO INTERNET, INC.
Registrar Abuse Contact Email: abuse@gmo.jp
Registrar Abuse Contact Phone: +81.337709199

For some reason, none of the "URL Redirect Checkers" that I've tried, detects its redirection path ^{[quite strange]}!

[What happened:]

What happened:
Their self-moderated announcement caught my attention, so I did some digging and found various red flags...

✔ Self-moderated topic!
✔ Fake launch date ^{[they're claiming that they've launched on "27/01/2021", but "that's not the case"]}!
✔ Fake registration number and address ^{[they didn't even bother to change "these parts" from the "script [archived]" that they were using]}!
✔ A lot of plagiarized content!

Scammers Profile Link:
simbaexchange

Reference Link:
Simba Exchange the new P2P service Exchange for Crypto ^[archived]
Simbaxe.com ^[archived]

• About page ^[archived]

Other similar websites:

• Wollito.com ^{[archived - Creation Date: 2021-07-26]}
• Kriptoist.com ^{[archived - Creation Date: 2017-11-29]}

Additional Notes:

Domain name: simbaxe.com
Registrar URL: http://www.namecheap.com
Creation Date: 2022-01-17T11:07:29.00Z

Simba Cryptocurrency Exchange
Launch Date: 27/01/2021
Registration No: 394203107
Address: Acme St. 234/22 Cryptocity / CryptoWorld

Tagged and "created a flag".