Report Malware and Suspicious Links here so Mods can take Action !

[Charcol]

A fake topic has been found about a new blockchain project called Fairchain. Please take action against the user and topic.

User: Bambalam <-----  Please Ban this User

Fake thread: [CPU][MOBILE] sha256mem | FAIRCHAIN ~ Mainnet Countdown: 3 Days.

Fake File:

Code:

[b]Website:[/b] https://github.com/bams-repo/go-chain
[b]Source:[/b] https://github.com/bams-repo/go-chain

Reference: https://www.virustotal.com/gui/file/d819ffcb5969806624e726b09e42578148c92df839d6ec53887e21186c41ab80/detection

[AakZaki]

This account posted an Airdrop where his website link was suspicious and even dangerous and he included the link in his signature on his profile.
And this account is connected to the account that cheated the campaign here

Account: piebeyb<= Please Banned
Fake ANN Thread: GIPIECOIN ( GIPIE ) - GipieCoin - Free Play, Stake, Daily Claim & Win
archive

Code:

👉 Join now: https://gipiecoin.xyz/airdrop/prediction

When the link is clicked, it will lead to the OKX Wallet extension and show the following message

Code:

chrome-extension://mcohilncbfahbmgdjkbpemcciiolgcge/domain-warning.html

VirusTotal Scan Result: https://www.virustotal.com/gui/url/a4fbdc22e10cf74c39e424fbc162b9acade204a717aa4dfd4d7a7bae171d747d

[piebeyb]

This account posted an Airdrop where his website link was suspicious and even dangerous and he included the link in his signature on his profile.
And this account is connected to the account that cheated the campaign here

Account: piebeyb<= Please Banned
Fake ANN Thread: GIPIECOIN ( GIPIE ) - GipieCoin - Free Play, Stake, Daily Claim & Win
archive

Code:

👉 Join now: https://gipiecoin.xyz/airdrop/prediction

When the link is clicked, it will lead to the OKX Wallet extension and show the following message

Code:

chrome-extension://mcohilncbfahbmgdjkbpemcciiolgcge/domain-warning.html

VirusTotal Scan Result: https://www.virustotal.com/gui/url/a4fbdc22e10cf74c39e424fbc162b9acade204a717aa4dfd4d7a7bae171d747d

Just to clear things up about the OKX warning. This only started showing after we moved to a new contract and removed liquidity from the old pool. I get why that might trigger some alerts, since that kind of pattern is often linked to scams.

But in our case, it was just part of an update. The old contract is no longer used, and we deployed a new one with some improvements.
We’re not asking for private keys or anything like that, and there’s no forced transactions happening in the background. Also checked on other wallets like MetaMask, and there’s no warning there. So looks like it’s just a false flag on OKX side.

We’re already making some adjustments on the site and will submit a review request to get this sorted. If anyone’s unsure, better double check everything first before interacting. That’s always the safest way anyway.
 

[$crypto$]

Fake Thread --- Xenux maliciously spreads direct malware links.

Account: xenwork please ban
Fake ANN: (ANN) Xenux (XEN) - Privacy Coin with Rewarded Service Nodes. (RandomX)

Code:

[b]Light Wallet[/b]

- Windows: [url=https://codeberg.org/xenux/xenux-light-wallet/releases/download/v1.0.0/xenux-light-wallet-v1.0.0-windows-x86_64.zip]https://codeberg.org/xenux/xenux-light-wallet/releases/download/v1.0.0/xenux-light-wallet-v1.0.0-windows-x86_64.zip[/url]
- Linux: [url=https://codeberg.org/xenux/xenux-light-wallet/releases/download/v1.0.0/xenux-light-wallet-v1.0.0-linux-x86_64.tar.gz]https://codeberg.org/xenux/xenux-light-wallet/releases/download/v1.0.0/xenux-light-wallet-v1.0.0-linux-x86_64.tar.gz[/url]
- Codeberg release: [url=https://codeberg.org/xenux/xenux-light-wallet/releases/tag/v1.0.0]https://codeberg.org/xenux/xenux-light-wallet/releases/tag/v1.0.0[/url]

[b]Daemon CLI[/b]

- Windows: [url=https://codeberg.org/xenux/xenux/releases/download/v1.0.0/xenux-daemon-cli-v1.0.0-windows-x86_64.zip]https://codeberg.org/xenux/xenux/releases/download/v1.0.0/xenux-daemon-cli-v1.0.0-windows-x86_64.zip[/url]
- Linux: [url=https://codeberg.org/xenux/xenux/releases/download/v1.0.0/xenux-daemon-cli-v1.0.0-linux-x86_64.tar.gz]https://codeberg.org/xenux/xenux/releases/download/v1.0.0/xenux-daemon-cli-v1.0.0-linux-x86_64.tar.gz[/url]
- Codeberg release: [url=https://codeberg.org/xenux/xenux/releases/tag/v1.0.0]https://codeberg.org/xenux/xenux/releases/tag/v1.0.0[/url]

Virustotal: https://www.virustotal.com/gui/file/6923c309e16fbacd2f1090563ee1802d6bf5ebb1130ad2e0ca3faf195ccb768a/detection

[albon]

This user posted an announcement related to Solen Wallet, After a deep forensic analysis of the setup file Solen.Wallet_0.1.8_x64-setup.exe, it was confirmed to be a malicious Info-Stealer designed to target crypto users.

The file was identified as Malicious/Unsafe with detections such as: MALICIOUS | Unsafe | Generic ML PUA (PUA)

Detection rate: 4/71 engines on VirusTotal



The file seems to be built using Rust which some malware developers use since it can complicate analysis as it can make it harder for security tools to analyze it, It also drops a suspicious DLL file and tries to stay persistent by placing executable files in the AppData folder.

The installer drops a hidden executable here:

Code:

C:\Users<USER>\AppData\Local\Solen Wallet\solenwallet.exe

Malicious Library: It drops a temporary DLL to execute unauthorized commands:

Code:

...\AppData\Local\Temp\nsyC778.tmp\nsis_tauri_utils.dll

ANN thread: [ANN] Solen (SOLEN) | The Settlement Layer for the Modular Future

User : solen  <-----   Please Ban this User

Archived ANN thread: https://bitlist.co/post/66328033
 
VirusTotal scan result: https://www.virustotal.com/gui/file/fd05462d4d72650c515e5ef61a98e31c6fa853d2cd2c4f719b7f8e365029b373/behavior [Solen.Wallet_0.1.8_x64-setup.exe] Signature Status: Unsigned (BIG Red Flag)

[Charcol]

CoinMiner / Trojan / Riskware / HackTool / Malicious has been detected in the file of an Altcoin Mining Guide/Promotion thread named Venera / VNR. I am highlighting all the details here. Please take action against that thread and user.

User: Toored <-----  Please Ban this User

Fake thread:  [GUIDE] Mine Venera (VNR) Early — Privacy Stablecoin Project + CPU Mining

Fake File:

⬇️ Download XMRig

Code:

wget https://github.com/xmrig/xmrig/releases/download/v6.24.0/xmrig-6.24.0-linux-static-x64.tar.gz

tar -xzf xmrig-6.24.0-linux-static-x64.tar.gz

cd xmrig-6.24.0

Reference:

https://www.virustotal.com/gui/file/129cfbfbe4c37a970abab20202639c1481ed0674ff9420d507f6ca4f2ed7796a/detection

[Repeat06]

This person commented on this topic, "Which brand of miner should I trust?" and added a link, which I found dangerous.

User: CoZmo73  <-------Please ban

Reply: https://bitcointalk.org/index.php?topic=5434552.msg61715173#msg61715173

https://www.talkimg.com/images/2026/05/12/UJKBt9.png

virustotal

[Mitchell]

This person commented on this topic, "Which brand of miner should I trust?" and added a link, which I found dangerous.

User: CoZmo73  <-------Please ban

Reply: https://bitcointalk.org/index.php?topic=5434552.msg61715173#msg61715173

[...]

virustotal

You are reporting them for sharing a link to the official canaan.io website? You must be joking

[Repeat06]

How to join the upcoming slow block demo on signe He asked to participate in this place. But his invitation has two suspicious links


Username  billscoresby <-------Please block

Fake Source :  How to join the upcoming slow block demo on signet

Real Source :  https://stacker.news/items/1464393
                     https://delvingbitcoin.org/t/consensus-cleanup-demo-of-slow-blocks-on-signet/2367

Reference:virustotal
Reference:virustotal

[Charcol]

How to join the upcoming slow block demo on signe He asked to participate in this place. But his invitation has two suspicious links


Username  billscoresby <-------Please block

Fake Source :  How to join the upcoming slow block demo on signet

Real Source :  https://stacker.news/items/1464393
                     https://delvingbitcoin.org/t/consensus-cleanup-demo-of-slow-blocks-on-signet/2367

Reference:virustotal
Reference:virustotal

I don't see much of a problem here. In some cases, even obvious official links can be found as malicious when scanned on Virustotal. Even if you scan Virustotal with your Telegram username, that will still show as a warning sign. So next time, be completely sure. Then submit a report to the moderators.

[Zaka1221]

Today I found 2 new fake topics SMEEcoin and Lumora and  i am submitting all detail here please take action against users and topic

User: kudakov Please Ban this user

Fake ANN thread: [ANN] (SMC) SMEEcoin - based on Kaspa, enhanced with RandomX

Fake File:

Code:

https://github.com/SMEEcoin/SMEEcoin

Reference:
https://www.virustotal.com/gui/file/d48ddccd1c11117f77356087993e283a85756d6270333387cee51521940937fd/detection


User: maxyfun Please Ban this user

Fake ANN thread: [ANN] Lumora – GPU Mineable KawPoW Coin is Live!

Fake File:

Code:

https://github.com/Lumora-chain/Lumora/releases/download/v1.0/Lumora-Win64.zip

Reference:
https://www.virustotal.com/gui/file/b9ca0da32ef71e0c1f1f2812329b998266f65ace46ee0b3aa8be242c3858e398/detection

[$crypto$]

Possible fake Zama (ZAM) thread --- the wallet link, if downloaded it detected malicious files, although we know forks of Monero often show in virustotal detected many viruses including the original Monero file, because this project does not have credibility that is why I report here.

Account: ZamaCoin
Fake ANN: ANN] Zama (ZAM) — Africa's Digital Gold | Privacy Coin | CPU Mining | $0.10

Code:

  - Website: https://zamacoin.org
  - Wallet: https://zamacoin.org/wallet

https://zamacoin.org/downloads/zama-wallet-windows-x64.exe

https://www.virustotal.com/gui/file/ed486aece769af45d93b1d33e23820d529e8702d50e8f3469f28f5a7c1124977/detection

[AakZaki]

At first the site he shared looked fine, because previously many trusted members such as hugeblack and SRF10 commented. however, after the update made today, I see that this site seems to have been modified and now it is detected that this site contains Malware, Malicious and Phishing.

Account: hexturim<= Please Banned
Fake ANN Thread: 💹 GetRate — exchange monitoring without AML/KYC
archive

Code:

🌐 [url=https://getrate.cc/][b]GetRate[/b][/url] — Comprehensive Crypto Exchange Monitoring

VirusTotal Scan Result: https://www.virustotal.com/gui/url/08e7c00a43c094302d524c47ae54d6647b64a354a855a0abcf953219caa8fae6