Warining : phishing on electrum.net

[defdjamel]

be careful  electrum.net is a phishing website .
I have lost 1 bitcoin installing the fake application...
 
here transaction ID : https://blockstream.info/tx/825bf2963e3b88777fd8a323eeaf300a69676b7cc24929625c53c4d5ffec28f3
I want to die today...

[mk4]

That's unfortunate. Do you mind telling us how you fell for the phishing site? Was it through a Google ad?

The site seems down now though.

I want to die today...

Chin up mate. It's just money. It may be hard depending on what your income is, but money can be made back; whereas you only have one life.

[rdluffy]

Man, I'm sorry, it's really sad, but don´t you research first to see https://electrum.org is the original site?
Here in Bitcointalk people emphasize a lot that the only original source is https://electrum.org

[defdjamel]

I type on google "electrum" and google propose me "electrum.net" before validation , I click  on this proposition and I didn't see anything suspect.
it's just money of course , I will report this website at the French Police , I can believe  the website ,its still online and new people can be stolen again and again...

[mk4]

I type on google "electrum" and google propose me "electrum.net" before validation , I click  on this proposition and I didn't see anything suspect.
it's just money of course , I will report this website at the French Police , I can believe  the website ,its still online and new people can be stolen again and again...

So it definitely looks like it was through a Google ad.. Next time make sure to not click ads, and to think twice ALWAYS when clicking links regardless where. Also, if you'd buy the same amount of BTC in the future, please. Grab a hardware wallet.

Anyway, expensive mistake. Best of luck moving forward.

[rdluffy]

The best thing to do, is to look here on forum first, and have some information about
It looks like their website is down or something with the servers, let's keep looking for information, you are the first to come here, but I suspect a lot of people will lose BTC

[BitHodler]

Please calm down. What does that have to do with your death? Think of it one day, there are people who bought a pizza for 10000 BTC.

Please be more understanding. OP lost the money in a time where for a lot people this is more than they would be able to safe or make in a decade. Obviously, it's not a reason to feel like that, but it's not entirely uncommon.

The pizza story was at a time where Bitcoin was worth peanuts, and more importantly, the coins weren't lost but spent on pizzas. I'm actually not sure why you think these situations compare....

I am really sorry to read this. It's such a shame that scammers without a second thought ruin people's lives for their own selfish interests. OP, I really hope that you will try your best to start saving up satoshis from scratch even though you aren't thinking about that right now.

[KacperBTCrypto]

Thank you for info
It's only ~11k$, average American earns 70$/year so don't kill yourself, you will waste all your life

[Shenzou]

be careful  electrum.net is a phishing website .
I have lost 1 bitcoin installing the fake application...
 
here transaction ID : https://blockstream.info/tx/825bf2963e3b88777fd8a323eeaf300a69676b7cc24929625c53c4d5ffec28f3
I want to die today...

I really feel sorry for you man, when you are dealing with that amount of money you should really be sure and check not twice but multiple time that everything is alright, but i think that somethings are really hard to avoid, and sometimes you need to get a wake up call to start checking and being careful , but your wake up call had a really high price.

[defdjamel]

Thanks for all your messages !
this is a mistake from me and I was feeling so alone , nowhere to complain, no-one to contact...this is really hard.
anyway, scammers will pay for that.
electrum.net is still online... official site electrum.org should do something. this is not normal.
I open this discussion to warn people and hope that will avoid an other expensive mistake.

[livingfree]

Thanks for all your messages !
this is a mistake from me and I was feeling so alone , nowhere to complain, no-one to contact...this is really hard.
anyway, scammers will pay for that.
electrum.net is still online... official site electrum.org should do something. this is not normal.
I open this discussion to warn people and hope that will avoid an other expensive mistake.

The official site can't do anything but to warn, they have warning on their website already.

Warning: Electrum versions older than 3.3.4 are susceptible to phishing. Do not download Electrum from another source than electrum.org, and learn to verify GPG signatures.

It has been displayed on their website all of the time and google is known for putting those phishing links at the top because they can't classify if it's a scam or not. Sorry for your loss mate.

[Admant]

I am sure this is not very helpful for you, but I got the same today with my 0.75BTC (my entire wallet)
Exactly the same, but from electrumsky.com
Hard lession!
We could go for a beer... just not to feel too idiot

Best

A

[HCP]

electrum.net is already offline

However the electrumsky domain is still up and running. I've reported it to Google SafeBrowsing and have also filed an "abuse" complaint with the domain registrar here: https://publicdomainregistry.com/report-abuse-complain/

WHOIS result for electrumsky.com
Domain Name: ELECTRUMSKY.COM
Registry Domain ID: 2404872319_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.PublicDomainRegistry.com
Registrar URL: http://www.publicdomainregistry.com
Updated Date: 2019-06-21T19:12:14Z
Creation Date: 2019-06-21T19:12:13Z
Registry Expiry Date: 2020-06-21T19:12:13Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303
Registrar Abuse Contact Email: abuse-contact@publicdomainregistry.com
Registrar Abuse Contact Phone: +1.2013775952
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS1.ITITCH.COM
Name Server: NS2.ITITCH.COM
Name Server: NS3.ITITCH.COM
Name Server: NS4.ITITCH.COM
DNSSEC: unsigned

[defdjamel]

I am sure this is not very helpful for you, but I got the same today with my 0.75BTC (my entire wallet)
Exactly the same, but from electrumsky.com
Hard lession!
We could go for a beer... just not to feel too idiot

Best

A

I am sorry for that. and I can really understand you ...
Electrum.net is offline now ( server not respond).
yesterday I have report a complain to French Police, this is the only thing I can do.
i have also report the website to google.
i have contact let's encrypt ( ssl provider) and ask to disable this phishing website , here the crazy reply:

"Thanks for the report. Our current policy does not allow us to revoke certificates for sites suspected of engaging in phishing, distribution of malware, or other forms of fraud".

they don't revoke any frauds website !!!! thats completely crazy!
without ssl certificate I will be suspicious and maybe avoid this mistake.
For me they encourage phishing, malware... and they are participating in this fraud!

[HCP]

An SSL certificate has nothing to do with scams or fraud or trustworthiness of a website... Although it's a common sign of a scam website to make a big deal about the fact that they do have an SSL certificate

All an SSL cert does is allow them to offer https:// connectivity so that the connection to/from the website is encrypted.

[Pmalek]

An SSL certificate has nothing to do with scams or fraud or trustworthiness of a website...

Exactly, it only means that the connection between the user and the web server is encrypted. SSL certificates are cheap nowadays. I saw ads as low as $8 a year. Phishers and hackers will buy such cheap certificates solely for the reason that people think they are a sign of security.

[bob123]

Exactly, it only means that the connection between the user and the web server is encrypted. SSL certificates are cheap nowadays. I saw ads as low as $8 a year. Phishers and hackers will buy such cheap certificates solely for the reason that people think they are a sign of security.

You can get them for free.
Let'sEncrypt offers free TLS certificates. They don't even need to pay for it anymore.

But still, a lot of scams don't even bother get a certificate 
Anything which doesn't have a TLS certificate should be accessed with caution. Do not download software via http. At least not if you can't or won't verify the signature of the file.

 

[Pmalek]

Anything which doesn't have a TLS certificate should be accessed with caution. Do not download software via http. At least not if you can't or won't verify the signature of the file.

Anything in connection with financial information should not be entered on sites that don't have SSL certificates. In my everyday work I often come across sites used by my company that are not encrypted and use simple http, even in connection with login details. It is not the best practice but that is their problem and their hasn't been any security breaches that I am aware of.

But overall I agree that a non encrypted connection between you and the server should be avoided unless you absolutely trust the other party.

[bob123]

But overall I agree that a non encrypted connection between you and the server should be avoided unless you absolutely trust the other party.

If you transmit sensitive information via the internet, you already have to trust the other party.

Encryption does not protect you from the other party, you are basically encrypting for them to decrypt since you share the same key.

Encryption is necessary because everyone in between (every router, server, basically anyone who wants to listen to that) can read and modify the information.
You are protecting your data from a 3rd party, not from the server you are communicating with.

[Pmalek]

Never use insecure connection even if you trust the other party, insecure connection is vulnerable to MITM attack which can be used to collect user's data & manipulate send/received data (such as edit Bitcoin address).

I understand but unfortunately in my line of work I am sometimes forced to do that.
What I do in private is a different thing, especially with Bitcoin, wallets, etc. But my company provides us with several sites that uses shared login details between several partners and some of the sites are unfortunately not encrypted.