[List] Phishing Cryptocurrency Site

[Chikito]

Scam/Phishing validatewebwallets.online

Code:

https://validatewebwallets.online/

The website is a collective scam wallet where the user must put the mnemonic seed

IP Address: 198.54.115.144
Domain Name: VALIDATEWEBWALLETS.ONLINE
Registry Domain ID: D219626518-CNIC
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: https://namecheap.com
Updated Date: 2021-01-29T18:56:17.0Z
Creation Date: 2021-01-29T18:56:02.0Z
Registry Expiry Date: 2022-01-29T23:59:59.0Z
Registrar: Namecheap
Registrar IANA ID: 1068

Don't get in a trap.

[$crypto$]

Fake Giveaway Elon Musk

Again, fake Twitter with the name Elon Musk is familiar to me to find something like this, it will still be if the domain is new then I need to publish it here so that many people know and understand that this is a real scam.

Website:

Code:

https://twitterspacex.com/
https://getspacexdrop.com/

Archive

[Chikito]

Phishing 1lnch.com and eosuniswap.org

Code:

http://eosuniswap.org/

IP Address: 80.78.22.45
Domain Name: EOSUNISWAP.ORG
Registry Domain ID: D402200000015649763-LROR
Registrar WHOIS Server: whois.tucows.com
Registrar URL: http://www.tucows.com
Updated Date: 2021-01-29T17:59:10Z
Creation Date: 2021-01-07T13:52:43Z
Registry Expiry Date: 2022-01-07T13:52:43Z
Registrar Registration Expiration Date:
Registrar: Tucows Inc.
Registrar IANA ID: 69
Registrar Abuse Contact Email: domainabuse@tucows.com

Code:

https://1lnch.com

IP Address: 185.178.208.154
Domain Name: 1LNCH.COM
Registry Domain ID: 2585842188_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-01-21T18:09:35Z
Creation Date: 2021-01-19T19:54:12Z
Registry Expiry Date: 2022-01-19T19:54:12Z
Registrar: NameCheap, Inc.
Registrar IANA ID: 1068
Registrar Abuse Contact Email: abuse@namecheap.com

Again, don't searching in the google searching box, both are appear in there. don't get in a trap by typing mnemonic seed into a phishing website.

[Baofeng]

There favourite fake of Crypto scam, Elon Musk:

Code:

https://elon-bonus.org/

Archive: https://archive.is/xYkzi

Registrar    NameCheap, Inc.
IANA ID: 1068
URL: http://www.namecheap.com
Whois Server: whois.namecheap.com

(p)
Registrar Status    addPeriod, serverTransferProhibited
Dates    4 days old
Created on 2021-01-30
Expires on 2022-01-30
Updated on 2021-01-30    
 
Name Servers    DNS1.NAMECHEAPHOSTING.COM (has 1,025,457 domains)
DNS2.NAMECHEAPHOSTING.COM (has 1,025,457 domains)
   
 
Tech Contact    —
IP Address    198.54.120.190 - 101 other sites hosted on this server

[Chikito]

Phishing walletsconnect.org

Code:

http://walletsconnect.org

IP Address: 169.255.59.11

Domain Name: WALLETSCONNECT.ORG
Registry Domain ID: D402200000015870070-LROR
Registrar WHOIS Server: whois.web4africa.net
Registrar URL: https://www.web4africa.net
Updated Date: 2021-01-31T01:29:14Z
Creation Date: 2021-01-31T01:29:13Z
Registry Expiry Date: 2022-01-31T01:29:13Z
Registrar Registration Expiration Date:
Registrar: Web4Africa Inc.
Registrar IANA ID: 664
Registrar Abuse Contact Email: abuse@web4africa.ne

A website needs your mnemonic seed. just write it carefully if you want to be lost at all

[Baofeng]

another of these fake UNI giveaways. Stay away, there's no more airdrop or UNI giveaways

Website:

Code:

 https://uni2021.org/
https://2021uni.org/

archived: https://archive.is/q0vxN

Registrar    Tucows Inc.
IANA ID: 69
URL: http://www.tucows.com
Whois Server: whois.tucows.com

(p)
Registrar Status    clientTransferProhibited, clientUpdateProhibited, serverTransferProhibited
Dates    19 days old
Created on 2021-01-23
Expires on 2022-01-23
Updated on 2021-01-23    
  
Name Servers    NS101.CLOUDNS.NET (has 206,922 domains)
NS102.CLOUDNS.NET (has 206,922 domains)
NS103.CLOUDNS.NET (has 206,922 domains)
NS104.CLOUDNS.NET (has 206,922 domains)
   
  
Tech Contact    —
IP Address    185.178.208.165 - 68 other sites hosted on this server

[Baofeng]

Interesting to see a .ir (Iran) ccTLD now. Seems that Elon Musk face is all over the world now specially with his company and the recent news of the $1.5 billion crypto investment.

Website:

Code:

https://dropmuskx.ir/

Dates    Expires on 2022-01-25
Updated on 2021-01-27    
 
Name Servers    COREY.NS.CLOUDFLARE.COM (has 17,663,523 domains)
LUCIANA.NS.CLOUDFLARE.COM (has 17,663,523 domains)
   
 
Tech Contact    —
IP Address    104.21.73.63 - 423 other sites hosted on this server

[CryptoYar]

This is another fake giveaway website. But this time the dogecoin has also been included for their dirty scam.

What happened:: Fake Giveaways.

Website Link:

Code:

https://musk.help/btc
https://musk.help/eth
https://musk.help/doge

Archive Link: https://archive.vn/0NMUT

1 days old
Created on 2021-02-15
Expires on 2022-02-15
Updated on 2021-02-15

https://whois.domaintools.com/musk.help

[Baofeng]

Another one of the fake Elon Musk giveaway:

Code:

https://elon-musk.life/

Archived: https://archive.is/GQdVi

Dates    4 days old
Created on 2021-02-14
Expires on 2022-02-14
Updated on 2021-02-14    
 
Name Servers    COCO.NS.CLOUDFLARE.COM (has 17,646,005 domains)
FELIPE.NS.CLOUDFLARE.COM (has 17,646,005 domains)
   
 
Tech Contact    REDACTED FOR PRIVACY (DT)
REDACTED FOR PRIVACY
REDACTED FOR PRIVACY (DT),
REDACTED FOR PRIVACY (DT), REDACTED FOR PRIVACY, REDACTED FOR PRIVACY (DT), REDACTED FOR PRIVACY
(p) (f)
IP Address    172.67.207.146 - 6 other sites hosted on this server

[Baofeng]

Zilliq coin fake giveaway:

Code:

http://zilmerits.com/

Archive: https://archive.is/kTrKs

Registrar    OwnRegistrar, Inc.
IANA ID: 1250
URL: http://www.ownregistrar.com
Whois Server: whois.ownregistrar.com

(p)
Registrar Status    clientTransferProhibited, ok
Dates    2 days old
Created on 2021-02-18
Expires on 2022-02-18
Updated on 2021-02-18    
 
Name Servers    NSA.WHOGOHOST.COM (has 63,013 domains)
NSB.WHOGOHOST.COM (has 63,013 domains)
   
 
Tech Contact    REDACTED FOR PRIVACY (DT)
WhoisSecure
18 San Carlos Street,
Los Angeles, California, 94110, us

(p)
IP Address    198.12.126.210 - 201 other sites hosted on this server

[Baofeng]

Scammers won' stop with the Tesla and Elon Musk fake giveaways:

Code:

https://elontesla.me/

Archived: https://archive.is/rRjhu

Dates    2 days old
Created on 2021-02-22
Expires on 2022-02-22
Updated on 2021-02-22    
  
Name Servers    ALBERT.NS.CLOUDFLARE.COM (has 17,670,101 domains)
DESI.NS.CLOUDFLARE.COM (has 17,670,101 domains)
   
  
Tech Contact    —
IP Address    104.21.82.154 - 428 other sites hosted on this server

[Chikito]

Fake Ads Bitcoin.org (bitciioin.org)

NAMECHEAP INC
Whois Serverwhois.namecheap.com
Referral URLhttp://www.namecheap.com
StatusaddPeriod https://icann.org/epp#addPeriod
serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Important Dates
Expires On ; 2022-02-05
Registered On ; 2021-02-05

scammer use fake ads bitcoin.org to get a new user to download the wallet from the phishing, be a careful noob.

[Baofeng]

Fake Elon Musk 5,000 BTC & 100,000 ETH & 100,000,000 DOGE Airdrop

Website:

Code:

https://muskteam.ml/?i=1

Archived: https://archive.is/D4g4U

Whois not available when I post this.

[CryptoYar]

Another BNB fake giveaway

Website:

Code:

https://bnbbinance.com/

Archived: https://web.archive.org/web/20210301042039/https://bnbbinance.com/

Domain name: bnbbinance.com
Registry Domain ID: 2593376216_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 0001-01-01T00:00:00.00Z
Creation Date: 2021-02-23T09:30:45.00Z
Registrar Registration Expiration Date: 2022-02-23T09:30:45.00Z
Registrar: NAMECHEAP INC

who is data

[Baofeng]

Another of this Elon Musk 5,000 BTC & 100,000 ETH & 100,000,000 DOGE Airdrop

Code:

http://musk-ch.com/

Archived: https://archive.is/gxFWc

Registrar    Epik Holdings Inc Epik Inc.
IANA ID: 617
URL: http://www.epik.com
Whois Server: whois.epik.com

(p)
Registrar Status    clientTransferProhibited
Dates    4 days old
Created on 2021-02-27
Expires on 2022-02-27
Updated on 2021-02-27    
 
Name Servers    NS1.20MB.NL (has 96 domains)
NS2.20MB.NL (has 96 domains)
   
 
Tech Contact    Privacy Administrator
Anonymize, Inc.
1100 Bellevue Way NE, Ste 8A-601,
Bellevue, WA, 98004, us

(p)
IP Address    185.239.243.112 - 75 other sites hosted on this server

[Baofeng]

More of Elon Musk fake giveaways:

Code:

https://musk-e-giveaway.live/
https://elon-m-giveaway.live/
https://musk-elon-giveaway.me/
https://tesla3.team/
https://tesla3.space/
https://musk-airdrop.org/

[Chikito]

Fake aave give away

Code:

https://aave.fund/

the user must send aave first to fake doubled balance.

scammer address still 0; https://etherscan.io/address/0x949D0054aD1f5aBc69EA8bFd0436132a11A4ab34 even the website proof has a lot of fake transaction.

IP Address: 186.2.161.142
Domain Name: aave.fund
Registry Domain ID: ee84de63484045f181f1277a5fe7ffc0-DONUTS
Registrar WHOIS Server: whois.tucows.com
Registrar URL: http://www.tucows.com
Updated Date: 2021-03-10T16:48:57Z
Creation Date: 2021-03-10T16:48:55Z
Registry Expiry Date: 2022-03-10T16:48:55Z
Registrar: Tucows Domains Inc.
Registrar IANA ID: 69
Registrar Abuse Contact Email: domainabuse@tucows.com
Registrar Abuse Contact Phone: 416.535.0123x1283

That IP's address has Flagged as Malicious by many anti-virus providers: https://www.virustotal.com/gui/ip-address/186.2.161.142/detection

just be careful.
 

[Chikito]

Fake Myetherwallet and Uniswap.

Code:

https://www.myetherwallet.love

Code:

https://app.uniswap.sg

Domain Name: MYETHERWALLET.LOVE
Registry Domain ID: D225757403-CNIC
Registrar WHOIS Server: whois.west.cn
Registrar URL: http://www.west.cn
Updated Date: 2021-03-13T11:16:12.0Z
Creation Date: 2021-03-13T11:05:48.0Z
Registry Expiry Date: 2022-03-13T23:59:59.0Z

IP Address: 162.213.251.198
Domain Name: app.uniswap.sg

IP Relationship > https://www.virustotal.com/gui/ip-address/162.213.251.198/relations



The IP's Connected a lot of phishing, be aware, the scammer will continue using the same server to create one.

[Baofeng]

Another Elon Musk fake giveaway:

Code:

teslab.us
https://elonmusk-gives.s3.amazonaws.com/index.html

archive: https://archive.is/6CZJP

Dates    2 days old
Created on 2021-03-12
Expires on 2022-03-12
Updated on 2021-03-12    
  
Name Servers    NS1.DNSOWL.COM (has 1,553,479 domains)
NS2.DNSOWL.COM (has 1,553,479 domains)
NS3.DNSOWL.COM (has 1,553,479 domains)
   
  
Tech Contact    REDACTED FOR PRIVACY (DT)
REDACTED FOR PRIVACY (DT),
REDACTED FOR PRIVACY (DT), CA, REDACTED FOR PRIVACY (DT), us
(p)
IP Address    107.161.23.204 - 159 other sites hosted on this server

[$crypto$]

I found a phishing site with the name Trezor again. I think it's not only that there will definitely be more wallet phishing sites that want to drain your wallet, so I think we need as much as possible to catch it.

Web Phishing Trezor

Code:

https://xn--trezr-xob.com/

6 days old
Created on 2021-03-09
Expires on 2022-03-09
Updated on 0000-12-31