[List] Phishing Cryptocurrency Site

[Chikito]

Scam walletinterlink.com

Code:

https://walletinterlink.com/

Code:

https://walletinterlink.com/wallet/

the user must write 12/24 mnemonic seed to connect the hardware/software wallet.

.

IP Address: 68.65.122.141
Domain Name: WALLETINTERLINK.COM
Registry Domain ID: 2599482937_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-03-21T17:10:07Z
Creation Date: 2021-03-21T17:09:44Z

.

[Baofeng]

Time to update another Elon Musk fake giveway:

Code:

https://teslatw.org/

Archive: https://archive.is/d40mm

Registrar    NameCheap, Inc.
IANA ID: 1068
URL: http://www.namecheap.com
Whois Server: whois.namecheap.com

(p)
Registrar Status    addPeriod, serverTransferProhibited
Dates    2 days old
Created on 2021-03-31
Expires on 2022-03-31
Updated on 2021-03-31    
  
Name Servers    LARS.NS.CLOUDFLARE.COM (has 18,240,762 domains)
MAGDALENA.NS.CLOUDFLARE.COM (has 18,240,762 domains)
   
  
Tech Contact    —
IP Address    172.67.192.94 - 6 other sites hosted on this server

[Chikito]

Another Fake Electrum Wallet

Code:

https://electrum-i.com/

That's IP's had a lot of relation of fake wallet; https://www.virustotal.com/gui/ip-address/47.91.72.40/relations

Code:

jaxx-w.com
exodus-i.com
electrum-i.com
myetherwalletj.net
myetherwalletl.com
blockchain-i.at
colnbose.com
myeteherwalete.com
myeterwallet.at

Who is IP/domain;

Domain Name: electrum-i.com
IP Address: 47.91.72.40
Domain Name: ELECTRUM-I.COM
Registry Domain ID: 2602721319_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.webnic.cc
Registrar URL: http://www.webnic.cc
Updated Date: 2021-04-04T19:30:30Z
Creation Date: 2021-04-04T09:33:05Z
Registry Expiry Date: 2022-04-04T09:33:05Z
Registrar: Web Commerce Communications Limited dba WebNic.cc
Registrar IANA ID: 460

Be careful to double-check and verify the download.

[Baofeng]

Another fake Elon Musk giveaway

Code:

https://embitcoins.org/

Archived: https://archive.is/Jy5Jq

Registrant Org    Privacy service provided by Withheld for Privacy ehf
Registrant Country    is
Registrar    NameCheap, Inc.
IANA ID: 1068
URL: http://www.namecheap.com
Whois Server: whois.namecheap.com

(p)
Registrar Status    serverTransferProhibited
Dates    9 days old
Created on 2021-03-30
Expires on 2022-03-30
Updated on 2021-03-30    
 
Name Servers    DNS1.NAMECHEAPHOSTING.COM (has 1,067,851 domains)
DNS2.NAMECHEAPHOSTING.COM (has 1,067,851 domains)
   
 
Tech Contact    —
IP Address    198.187.31.229 - 544 other sites hosted on this server

[Super Bitard]

How do you have to be a fool to fall for this link? Not a bit like the official link

[$crypto$]

FAKE Trezor Wallert

Code:

https://wallet.xn--trer-dbb4416b.com/

Archived: https://archive.is/wip/ofumJ



The more phishing like this, I think the things scammers can do on this site, the most important thing for many people is to make them aware of this, especially beginners.

The Trezor and Nano Ledger hardware wallets are typically targeted by scammers with phishing sites.

[Chikito]

How do you have to be a fool to fall for this link? Not a bit like the official link

people with carelessness and who don't care to double-check the website will fall into this trap. people who engage in google searching would be the scammer target also. people who always perform the advice will be safe.

[Chikito]

Phishing Myetherwallet

Code:

https://myeteherewalete.com/

the website will ask the user to input mnemonic phrase or Ethereum private key.

website created on 17 April 2021.

Domain Name: MYETEHEREWALETE.COM
Registry Domain ID: 2605814689_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namesilo.com
Registrar URL: http://www.namesilo.com
Updated Date: 2021-04-17T18:12:20Z
Creation Date: 2021-04-17T18:12:19Z
Registry Expiry Date: 2022-04-17T18:12:19Z
Registrar: NameSilo, LLC
Registrar IANA ID: 1479

Be careful to do not to get into the trap.

[Baofeng]

Fake and phishing site of https://foundation.app/, an NFT marketplace

Code:

https://foundatlon.app/

Registrant    REDACTED FOR PRIVACY
Registrant Org    Privacy service provided by Withheld for Privacy ehf
Registrant Country    is
Registrar    Namecheap Inc.
IANA ID: 1068
URL: https://www.namecheap.com/
Whois Server: whois.namecheap.com

(p)
Registrar Status    addPeriod, clientTransferProhibited
Dates    1 days old
Created on 2021-04-21
Expires on 2022-04-21
Updated on 2021-04-21

[Chikito]

Phishing Exodus Wallet

Code:

https://exocdus.com

IP Address: 185.178.208.156
Domain Name: EXOCDUS.COM
Registry Domain ID: 2579208200_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.reg.com
Registrar URL: http://www.reg.ru

the website will ask you to write your secret backup code, don't trap it.

[CryptoYar]

What happened: Riskmoon coin Fake giveaway

Website Link:

Code:

http://riskmoongiveaway.com/

Archive Link: https://archive.vn/K5Lwm



No domain information available

IP Address: 185.244.36.172
Domain Name: RISKMOONGIVEAWAY.COM
Registry Domain ID: 2607346419_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-04-24T10:34:36Z
Creation Date: 2021-04-24T10:33:35Z
Registry Expiry Date: 2022-04-24T10:33:35Z
Registrar: NameCheap, Inc.
Registrar IANA ID: 1068
Registrar Abuse Contact Email: abuse@namecheap.com

[Chikito]

No domain information available

you can check using IP/domain tools such as https://ipinfo.info/html/ip_checker.php

Code:

http://riskmoongiveaway.com

IP Address: 185.244.36.172
Domain Name: RISKMOONGIVEAWAY.COM
Registry Domain ID: 2607346419_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-04-24T10:34:36Z
Creation Date: 2021-04-24T10:33:35Z
Registry Expiry Date: 2022-04-24T10:33:35Z
Registrar: NameCheap, Inc.
Registrar IANA ID: 1068
Registrar Abuse Contact Email: abuse@namecheap.com

that domain was created just 3 days ago. look that scam purpose only.

you have also checked the relationship IP using virustotal tools: https://www.virustotal.com/gui/ip-address/185.244.36.172/relations

then you will find that IP only creates for scams purpose.

Code:

www.moonboysgiveaway.safemoonreward.net
www.hoglgiveaway.finance
...
etc

[CryptoYar]

No domain information available

you can check using IP/domain tools such as https://ipinfo.info/html/ip_checker.php

I was trying to get the domain name information through domaintools.com but maybe there was some issue in this tool, that's why I was failed to get domain info. However, it is working perfectly right now.

you have also checked the relationship IP using virustotal tools: https://www.virustotal.com/gui/ip-address/185.244.36.172/relations

Nice I will try. Thank you

[Chikito]

Fake Chipmixer.co.uk (chipmixkd2wgbqoy.onion)

Code:

https://chipmixer.co.uk/

Code:

chipmixkd2wgbqoy.onion

Domain Name: chipmixer.co.uk
IP Address: 104.21.38.201

https://www.virustotal.com/gui/ip-address/104.21.38.201/relations



No onion link available when putting that site into the TOR browser.

the real chipmixer will provide an onion link as the picture below,

[$crypto$]

FAKE Giveaway QTUM

Website

Code:

https://www.qtum.claims/block.html

Archived: https://archive.is/d4hp9

11 days old
Created on 2021-04-21
Expires on 2022-04-21
Updated on 2021-04-26

https://whois.domaintools.com/qtum.claims






There is a lot of rubbish giveaway like this, I think you have to be careful whoever offers it on the telegram line should avoid it.

Real Website: https://qtum.org/en

[ChipMixer]

the real chipmixer will provide an onion link as the picture below,

If website provides onion link (as pictured) - it still may not be real website.
If unsure - check ChipMixer ANN thread: https://bitcointalk.org/index.php?topic=1935098

[CryptoYar]

What happened: Another Riskmoon Fake Giveaway

Website Link:

Code:

http://riskmoon-giveaway.net/

Archive Link: https://archive.vn/KBKfA



Scammer wallet: https://bscscan.com/address/0x3222467cdC2Ef5799D992443869Ef6F547D0C7e3

Domain name info

Registrar Status   clientTransferProhibited, ok
Dates   2 days old
Created on 2021-05-02
Expires on 2022-05-02
Updated on 2021-05-02

https://whois.domaintools.com/riskmoon-giveaway.net

[$crypto$]

Fake Trustpad (TPAD) FLASH Token-Sale is LIVE

Website Fake:

Code:

https://trustpad-sale.com/

Archived: https://archive.is/VnLUg

4 days old
Created on 2021-05-01
Expires on 2022-05-01
Updated on 2021-05-01

https://whois.domaintools.com/trustpad-sale.com



Trustpad will officially announce the white list in public sale and it will be announced in the medium.
So what is listed above is clearly a scam they are continuing to take advantage of the project situation which is going on a public sale so do not send ETH or USDT / USDC / TUSD in the wallet below.

Address Scammers

Code:

0x66987428309B05391270FD101f96083086D0d725

TrustPad Official Group: https://t.me/TrustPad

TrustPad FAKE: https://t.me/tpaadsale

[CryptoYar]

Another fake giveaway by the same group of scammers.

Website:

Code:

http://riskmoon-giveaway.com/

https://archive.vn/Lnnvo

scammers wallet: 0x3222467cdC2Ef5799D992443869Ef6F547D0C7e3 ( previously used in riskmoon-giveaway.net)

Domain:
Registrar Status   clientTransferProhibited
Dates   1 days old
Created on 2021-05-04
Expires on 2022-05-04
Updated on 2021-05-04
whois info source

[Chikito]

Another fake giveaway by the same group of scammers.

Website:

Code:

http://riskmoon-giveaway.com/

It's the same relationship IP address as your post above

That IP has been flagged. when I look at the relationship > https://www.virustotal.com/gui/ip-address/185.244.36.172/relations
I find another giveaway such:  holg-giveaway.

Code:

holg-giveway.com

4 days old
Created on 2021-05-01
Expires on 2022-05-01
Updated on 2021-05-01

https://whois.domaintools.com/trustpad-sale.com

That IP also related on this site, which providing high return investment (possible scam).

Code:

https://247smartnet.online/

the real chipmixer will provide an onion link as the picture below,

If website provides onion link (as pictured) - it still may not be real website.
If unsure - check ChipMixer ANN thread: https://bitcointalk.org/index.php?topic=1935098

Thanks to point that. I had already also reported the .onion link at the past. seems all those already baned.