Bitcoin Forum
April 25, 2024, 03:48:02 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: [WARNING] electrumupdatefiles.com - Fake site hosting malicious electrum apps  (Read 74 times)
logfiles (OP)
Copper Member
Legendary
*
Offline Offline

Activity: 1960
Merit: 1638


Top Crypto Casino


View Profile WWW
October 18, 2020, 08:46:11 PM
Last edit: July 19, 2023, 08:54:00 PM by logfiles
Merited by ABCbits (5), suchmoon (4), noorman0 (1)
 #1

What happened: electrumupdatefiles.com is a website created with ill intentions. It hosts fake electrum apps with the intention to either phish victims Private Keys or Seed phrases or spread malware in the computer.

Scammers Profile Link: N/A

Scammer's website Link: electrumupdatefiles.com - DO NOT OPEN AND DOWNLOAD THE FILES ON YOUR COMPUTER
Archived: https://archive.vn/v5SEP

How the website apps:



The website in question was created only 6 months ago according to the domain information

Quote
Domain: electrumupdatefiles.com
Registrar: Namecheap, Inc.
Registered On: 2020-04-26
Expires On: 2021-04-26
Updated On: 2020-04-26
Status: clientTransferProhibited
Name Servers: dns1.namecheaphosting.com
dns2.namecheaphosting.com
https://www.whois.com/whois/electrumupdatefiles.com

Additional Notes:
  • The only genuine website for Electrum Bitcoin wallet is https://electrum.org
  • Previous releases are only found in https://download.electrum.org/
  • Always verify GPG signatures of the files before installing even if you downloaded them from the official website

█████████████████████████
████▐██▄█████████████████
████▐██████▄▄▄███████████
████▐████▄█████▄▄████████
████▐█████▀▀▀▀▀███▄██████
████▐███▀████████████████
████▐█████████▄█████▌████
████▐██▌█████▀██████▌████
████▐██████████▀████▌████
█████▀███▄█████▄███▀█████
███████▀█████████▀███████
██████████▀███▀██████████
█████████████████████████
.
BC.GAME
▄▄░░░▄▀▀▄████████
▄▄▄
██████████████
█████░░▄▄▄▄████████
▄▄▄▄▄▄▄▄▄██▄██████▄▄▄▄████
▄███▄█▄▄██████████▄████▄████
███████████████████████████▀███
▀████▄██▄██▄░░░░▄████████████
▀▀▀█████▄▄▄███████████▀██
███████████████████▀██
███████████████████▄██
▄███████████████████▄██
█████████████████████▀██
██████████████████████▄
.
..CASINO....SPORTS....RACING..
█░░░░░░█░░░░░░█
▀███▀░░▀███▀░░▀███▀
▀░▀░░░░▀░▀░░░░▀░▀
░░░░░░░░░░░░
▀██████████
░░░░░███░░░░
░░█░░░███▄█░░░
░░██▌░░███░▀░░██▌
░█░██░░███░░░█░██
░█▀▀▀█▌░███░░█▀▀▀█▌
▄█▄░░░██▄███▄█▄░░▄██▄
▄███▄
░░░░▀██▄▀


▄▄████▄▄
▄███▀▀███▄
██████████
▀███▄░▄██▀
▄▄████▄▄░▀█▀▄██▀▄▄████▄▄
▄███▀▀▀████▄▄██▀▄███▀▀███▄
███████▄▄▀▀████▄▄▀▀███████
▀███▄▄███▀░░░▀▀████▄▄▄███▀
▀▀████▀▀████████▀▀████▀▀
The block chain is the main innovation of Bitcoin. It is the first distributed timestamping system.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
TheUltraElite
Legendary
*
Offline Offline

Activity: 2856
Merit: 1219


Call your grandparents and tell them you love them


View Profile WWW
October 19, 2020, 05:55:05 AM
 #2

@logfiles

Can you tell us how you found out about this website? I ask this because a normal user would not think of typing these names on the search bar and ending up on this website without someone telling them to update their wallet using this "method".

I suspect there may be some people who are propagating this scam - unless they are getting SEOed from other sources. Huh

It might be possible that they are posting them on email lists or so too. No wonder we keep on saying that users should bookmark the real site for use.

R


▀▀▀▀▀▀▀██████▄▄
████████████████
▀▀▀▀█████▀▀▀█████
████████▌███▐████
▄▄▄▄█████▄▄▄█████
████████████████
▄▄▄▄▄▄▄██████▀▀
LLBIT
  CRYPTO   
FUTURES
 1,000x 
LEVERAGE
COMPETITIVE
    FEES    
 INSTANT 
EXECUTION
.
   TRADE NOW   
TryNinja
Legendary
*
Offline Offline

Activity: 2814
Merit: 6971



View Profile WWW
October 19, 2020, 06:02:07 AM
 #3

Can you tell us how you found out about this website?
I have found a very similar one on Google last week.

I searched where the Electrum directory is located on different operating systems to help and user and found a Medium article that looks like this:

Quote
Please make sure you have the last Electrum Bitcoin Wallet, if not please download from here:
https://www.electrum.org/downloads/

The default wallet file is called default_wallet, which is created when you first run the application and is located in the /wallets folder.

~text from electrum https://electrum.readthedocs.io~

The content is correct and I almost didn't notice it, but the the top link that says "electrum.org" actually leads to https://www.electrumfiles.org < SCAM. The website isn't working now, but it looked exactly as this one.

It was one of the first results and it wasn't a paid Ad by Google, so they are most likely doing some kind of SEO to rank those fake articles higher.

.
.HUGE.
▄██████████▄▄
▄█████████████████▄
▄█████████████████████▄
▄███████████████████████▄
▄█████████████████████████▄
███████▌██▌▐██▐██▐████▄███
████▐██▐████▌██▌██▌██▌██
█████▀███▀███▀▐██▐██▐█████

▀█████████████████████████▀

▀███████████████████████▀

▀█████████████████████▀

▀█████████████████▀

▀██████████▀▀
█▀▀▀▀











█▄▄▄▄
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
.
CASINSPORTSBOOK
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀▀█











▄▄▄▄█
logfiles (OP)
Copper Member
Legendary
*
Offline Offline

Activity: 1960
Merit: 1638


Top Crypto Casino


View Profile WWW
October 19, 2020, 11:37:55 AM
 #4

Can you tell us how you found out about this website? I ask this because a normal user would not think of typing these names on the search bar and ending up on this website without someone telling them to update their wallet using this "method".
It was some guide about Electrum wallet in either medium article or blog I found a couple of weeks back. Unfortunately I have not been successful in tracing the guide as I forgot to save the link. When I get the guide, It will share it.

If you read through guide, The malicious links were embedded within hypertexts which could easily trick newbies looking for guides.

█████████████████████████
████▐██▄█████████████████
████▐██████▄▄▄███████████
████▐████▄█████▄▄████████
████▐█████▀▀▀▀▀███▄██████
████▐███▀████████████████
████▐█████████▄█████▌████
████▐██▌█████▀██████▌████
████▐██████████▀████▌████
█████▀███▄█████▄███▀█████
███████▀█████████▀███████
██████████▀███▀██████████
█████████████████████████
.
BC.GAME
▄▄░░░▄▀▀▄████████
▄▄▄
██████████████
█████░░▄▄▄▄████████
▄▄▄▄▄▄▄▄▄██▄██████▄▄▄▄████
▄███▄█▄▄██████████▄████▄████
███████████████████████████▀███
▀████▄██▄██▄░░░░▄████████████
▀▀▀█████▄▄▄███████████▀██
███████████████████▀██
███████████████████▄██
▄███████████████████▄██
█████████████████████▀██
██████████████████████▄
.
..CASINO....SPORTS....RACING..
█░░░░░░█░░░░░░█
▀███▀░░▀███▀░░▀███▀
▀░▀░░░░▀░▀░░░░▀░▀
░░░░░░░░░░░░
▀██████████
░░░░░███░░░░
░░█░░░███▄█░░░
░░██▌░░███░▀░░██▌
░█░██░░███░░░█░██
░█▀▀▀█▌░███░░█▀▀▀█▌
▄█▄░░░██▄███▄█▄░░▄██▄
▄███▄
░░░░▀██▄▀


▄▄████▄▄
▄███▀▀███▄
██████████
▀███▄░▄██▀
▄▄████▄▄░▀█▀▄██▀▄▄████▄▄
▄███▀▀▀████▄▄██▀▄███▀▀███▄
███████▄▄▀▀████▄▄▀▀███████
▀███▄▄███▀░░░▀▀████▄▄▄███▀
▀▀████▀▀████████▀▀████▀▀
Furious 7
Hero Member
*****
Offline Offline

Activity: 2842
Merit: 641


https://duelbits.com/


View Profile
October 19, 2020, 12:54:12 PM
 #5

Can you tell us how you found out about this website? I ask this because a normal user would not think of typing these names on the search bar and ending up on this website without someone telling them to update their wallet using this "method".
It was some guide about Electrum wallet in either medium article or blog I found a couple of weeks back. Unfortunately I have not been successful in tracing the guide as I forgot to save the link. When I get the guide, It will share it.

If you read through guide, The malicious links were embedded within hypertexts which could easily trick newbies looking for guides.
I think the findings of @logfiles are quite good and publish them in this forum with guides in medium articles, of course for them they will read them and unless the article has not been deleted with the existing guidelines the hypertext is very dangerous because beginners certainly will not know about this so this quite a good catch for the OP.

Scamer will spread this through any social media, articles, Telegram is certainly a scamer looking for who doesn't know what and their target is like that.
So we have to be able to make more awareness.

███████████████████████████
███████▄████████████▄██████
████████▄████████▄████████
███▀█████▀▄███▄▀█████▀███
█████▀█▀▄██▀▀▀██▄▀█▀█████
███████▄███████████▄███████
███████████████████████████
███████▀███████████▀███████
████▄██▄▀██▄▄▄██▀▄██▄████
████▄████▄▀███▀▄████▄████
██▄███▀▀█▀██████▀█▀███▄███
██▀█▀████████████████▀█▀███
███████████████████████████
.
.Duelbits.
▄▄█▄▄░░▄▄█▄▄░░▄▄█▄▄
███░░░░███░░░░███
░░░░░░░░░░░░░
░░░░░░░░░░░░
▀██████████
░░░░░███░░░░
░░░░░███▄█░░░
░░██▌░░███░▀░░██▌
█░██░░███░░░██
█▀▀▀█▌░███░░█▀▀▀█▌
▄█▄░░░██▄███▄█▄░░▄██▄
▄███▄
░░░░▀██▄▀
.
REGIONAL
SPONSOR
███▀██▀███▀█▀▀▀▀██▀▀▀██
██░▀░██░█░███░▀██░███▄█
█▄███▄██▄████▄████▄▄▄██
██▀ ▀███▀▀░▀██▀▀▀██████
███▄███░▄▀██████▀█▀█▀▀█
████▀▀██▄▀█████▄█▀███▄█
███▄▄▄████████▄█▄▀█████
███▀▀▀████████████▄▀███
███▄░▄█▀▀▀██████▀▀▀▄███
███████▄██▄▌████▀▀█████
▀██▄█████▄█▄▄▄██▄████▀
▀▀██████████▄▄███▀▀
▀▀▀▀█▀▀▀▀
.
EUROPEAN
BETTING
PARTNER
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!