[List] Phishing Cryptocurrency Site

[Chikito]

Trezor Phishing Site: {Pay attention to the domain name again}

Exodus Phishing Site

Seems fake or phishing wallet will not decrease every day, the scammer uses the same trick and IP every creates a new domain. because I also find phishing atomic wallet again.

Code:

https://atomicwallet.dev/

https://archive.is/CfL7d

Domain Name: atomicwallet.dev
IP Address: 169.239.128.161
Registry Domain ID: 45E0B8631-DEV
Registrar WHOIS Server: whois.nic.google
Registrar URL: None
Updated Date: 2021-04-06T22:19:46Z
Creation Date: 2021-04-01T22:19:46Z
Registry Expiry Date: 2022-04-01T22:19:46Z
Registrar: NameSilo, LLC
Registrar IANA ID: 1479

just download and scanning wallet.exe using virus total;
https://www.virustotal.com/gui/file/20731b55bc3657f5fc65d94deb02182b63ec3ef4da8ac0a53eb7c553cd239d91/detection

[$crypto$]

Trezor Phishing Site: {Pay attention to the domain name again}

Exodus Phishing Site

Seems fake or phishing wallet will not decrease every day, the scammer uses the same trick and IP every creates a new domain. because I also find phishing atomic wallet again.

True, this is not a lie even almost every day keeps popping up wallets or phishing with new domains, I don't know how there is no prevention? I think it's useless to report the domain too because they will create a new one and the trick is the same.

The exodus phishing wallet is back with a new domain after I found it yesterday but it's still the same trick.

Website: exodus.cx
Archived: https://web.archive.org/web/20210617114319/https://exodus.cx/

Domain Name: exodus.cx
Registry Domain ID: 1881037-CoCCA
Registry WHOIS Server:: whois.coccaregistry.org
Updated Date: 2021-06-02T08:32:48.542Z
Creation Date: 2021-05-26T09:48:11.184Z
Registry Expiry Date: 2022-05-26T09:48:11.374Z
Registrar Registration Expiration Date: 2022-05-26T09:48:11.374Z
Registrar: CentralNic Ltd
Reseller: Paymall s.r.o.
Reseller Street Address: Opletalova 921/6, New Town
Reseller Other Address Info: Prague 1, 11000
Reseller Country: CZ (Registrar is GB )
Reseller Phone: +420.601523999
Reseller Fax: +420.775097485

[CryptoYar]

10,000,000 MATIC Fake Giveaway

Website link:

Code:

https://matic.gifts/info
https://matic.gifts/

Twitter:

Code:

 https://twitter.com/MATIC_BONUS

Scammer's wallet: https://polygonscan.com/address/0x97C0F0DD48Db9dd487D26108568a05F542cB230C

Dates   3 days old
Created on 2021-06-14
Expires on 2022-06-14
Updated on 2021-06-14

Whois

[CryptoYar]

50,000 ETH and  5000 BTC Fake Giveaway

Website link:

Code:

https://etherlive.org/ethgives
https://etherlive.org/btcgives

Scammer's wallets:

Code:

 
BTC: 17vmMJ2rtTiR8UnBj8WuhjhEe1MyyemEVx
ETH: 0xD96D23a1bafA5C544E3C0F2280feaD18453B6a8E

Dates   3 days old
Created on 2021-06-16
Expires on 2022-06-16
Updated on 2021-06-16

Whois

[$crypto$]

Fake Uniswap

Website:

Code:

https://xn--app-unswap-6sb.cc/

Archived: https://archive.is/wip/yiGKD

info whois
https://whois.domaintools.com/xn--app-unswap-6sb.cc



Uniswap
Pancakswap
1inch
Etc.
There will be more phishing sites they will continue to spread with the name of the famous and largest DEX exchange of course this will continue to be done by fraudsters to get more money.
I will continue to report in this thread and archive it.

Official site: https://app.uniswap.org/#/swap?lng=en-US

[Chikito]

Fake Investment with High return.

Code:

https://crypto-peak.net

And possible with fake-proof licenses also.



Whois Lookup

NetRange: 68.65.120.0 - 68.65.123.255
CIDR: 68.65.120.0/22
NetName: NCNET-7
NetHandle: NET-68-65-120-0-1
Parent: NET68 (NET-68-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS16626, AS11855, AS174, AS4323, AS3356, AS22612, AS20454, AS32421
Organization: Namecheap, Inc. (NAMEC-4)
RegDate: 2015-03-06
Updated: 2015-03-06
Comment: http://namecheap.com
Comment: for any abuse please use: abuse@namecheap.com
Ref: https://rdap.arin.net/registry/ip/68.65.120.0
OrgName: Namecheap, Inc.
OrgId: NAMEC-4
Address: 11400 W. Olympic Blvd. Suite 200
City: Los Angeles
StateProv: CA
PostalCode: 90064
Country: US
RegDate: 2011-01-28

IP RElationship with another phishing https://www.virustotal.com/gui/ip-address/68.65.122.141/relations

Code:

www.coinobase.com

[$crypto$]

MetaMask Phishing Site


Website:

Code:

https://metakmax.com/

Archived: https://archive.is/wip/6ivD3

Domain name: metakmax.com
Registry Domain ID: 2621214123_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 0001-01-01T00:00:00.00Z
Creation Date: 2021-06-21T17:34:14.00Z
Registrar Registration Expiration Date: 2022-06-21T17:34:14.00Z
Registrar: NAMECHEAP INC
Registrar IANA ID: 1068

Pay more attention to the domain, phishing will never go away once I do, increase your awareness to do any search on true google if you are more likely to be a trap for you.

Official site: https://metamask.io/

[Chikito]

Website: exodus.cx
Archived: https://web.archive.org/web/20210617114319/https://exodus.cx/

Exodus Wallet still the favorite of phisher to traping user, I found one,

Code:

https://exodus.ac

Domain Name: EXODUS.AC
Registry Domain ID: D503300001198542592-LRMS
Registrar WHOIS Server: whois.rrpproxy.net
Registrar URL: http://www.key-systems.net
Updated Date: 2021-05-29T19:25:34Z
Creation Date: 2021-05-29T19:25:29Z
Registry Expiry Date: 2022-05-29T19:25:29Z

IP relationship > https://www.virustotal.com/gui/ip-address/185.178.208.182/relations

[$crypto$]

Website: exodus.cx

Code:

https://exodus.ac

DEAD

Website:

Code:

https://exocdus.co/

Archived: https://web.archive.org/web/20210702120108/https://exocdus.co/

Domain Name: exocdus.co
Registry Domain ID: DF30A1D443461467F8407478A87604E7A-NSR
Registrar WHOIS Server:
Registrar URL: https://key-systems.net
Updated Date: 2021-05-31T10:15:26Z
Creation Date: 2021-05-26T10:15:20Z
Registry Expiry Date: 2022-05-26T10:15:20Z
Registrar: Key-Systems GmbH
Registrar IANA ID: 269

The appearance of phishing sites is almost the same as those found above.

Phishing still continues to rely on the same script and only the domains are constantly changed like this, there is no tired of the fraudsters continuing to take their actions by displaying on google ad pages when doing a search.

[Chikito]

Fake and Phishing pancakeswap tools

Code:

http://hiccup.pancakeswap.tools

https://archive.is/WNyeN

IP Address: 62.210.177.59
Geolocation: FR (France), N/A, N/A, N/A N/A - Google Maps
Reverse DNS: s12.cdn-hd.com
Domain Check
Domain Name: hiccup.pancakeswap.tools
Top Level Domain: TOOLS (Manufacturing Industry)

The relation IP address with scammer; https://www.virustotal.com/gui/ip-address/62.210.177.59/relations



Be careful nobs, always check the URL correctly, and don't give any seed/private key.

[$crypto$]

Trust Wallet Fake Wallet

Website:

Code:

https://xn--tustwallet-85b.com/

Archived: https://web.archive.org/web/20210708133029/https://xn--tustwallet-85b.com/

Domain name: xn--tustwallet-85b.com
Registry Domain ID: 2625228437_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 0001-01-01T00:00:00.00Z
Creation Date: 2021-07-08T12:19:57.00Z
Registrar Registration Expiration Date: 2022-07-08T12:19:57.00Z
Registrar: NAMECHEAP INC
Registrar IANA ID: 1068

Never enter a private key/phrase on this phishing site, it's clear that there are many traps now, avoid it and look at it more carefully.

Don't be in a hurry and truswallet never asks for a key phrase/key on its website.

[$crypto$]

Coinomi phishing site

Website:

Code:

https://tatsks.com/

Archived: https://web.archive.org/web/20210708144814/https://tatsks.com/

315 days old
Created on 2020-08-27
Expires on 2021-08-27
Updated on 2020-08-27

The trick is the same as above Coinomi also never asks for a phrase on its website and this is clearly a phishing site that asks for your phrase and I think in terms of domains, they are very different, only the script is the same, so pay attention again more carefully.

Scammers like him have spread many phishing sites with different or the same scripts, so don't just randomly enter suspicious phrases.

Official site: https://www.coinomi.com/en/

[Chikito]

Trust Wallet Fake Wallet

Coinomi phishing site

We found too many phishing wallet, trust wallet, coinomi and,

Phishing Metamask Wallet

Code:

https://meta-mask.co

The scammer uses the same trick as above by inserting the mnemonic seed to get all user coins. as we know metamask wallet only asks mnemonic seed if the user first registering the wallet. this means if already registered the user only needs a password. An important point is always double-checked the URL and bookmarked it into the browser.

Domain Information;

IP Address: 67.207.81.229
Domain Name: meta-mask.co
Registry Domain ID: DD0B3077F0D0F4E3B82D5AD385883EC41-NSR
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-05-22T14:42:01Z
Creation Date: 2021-05-17T14:41:56Z
Registry Expiry Date: 2022-05-17T14:41:56Z
Registrar: NameCheap, Inc.

again,

Phishing exodus wallet

Code:

https://exoduswebv.com/

never giving up your mnemonic seed into the phishing site.

[$crypto$]

Trust Wallet Fake Wallet

Trust Wallet Fake Wallet

Website:

Code:

https://trustwalleta.com/

Archived: https://web.archive.org/web/20210712114407/https://trustwalleta.com/

Created on 2021-07-12
Expires on 2022-07-12
Updated on 0000-12-31

The script remains the same as before, just changing the domain, pay attention again and never enter a phrase/seed on any site.

Keep your assets.

[CryptoYar]

Bitcoincash phishing website

Website:

Code:

https://www.bitcolncash.org/wallets/#mobile-wallets

Domain info:

242 days old
Created on 2020-11-12
Expires on 2021-11-12
Updated on 2021-03-11

[$crypto$]

Metamask Phishing Wallet

Website:

Code:

https://extension-metamask.com.maxoutsms.com/
https://osterialatela.it/metamask/form.php

Archived:
https://archive.is/lDHVy
https://web.archive.org/web/20210713135755/https://extension-metamask.com.maxoutsms.com/

Domain Name: maxoutsms.com
Registry Domain ID: 2480891938_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2020-10-23T10:44:11Z
Creation Date: 2020-01-16T12:02:44Z
Registrar Registration Expiration Date: 2022-01-16T12:02:44Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146

Metamask is another target for phishing and now with this new domain the trick is almost the same just a little change in appearance but we should be able to examine it in more detail.

What @DroomieChikito said we should check the URL and bookmark it to the browser to make it much safer and no need to type again.

[$crypto$]

Dangerous sites never click them all phishing

Website:

Code:

https://x2elon.space/
https://m-poloniex.us/login-access/us-login/Login.php
https://bittrex-global-on.com/

Archived:
https://archive.is/wip/dDEgP
https://archive.is/wip/FmiHz
https://archive.is/wip/TdCUW

Info Domain
https://whois.domaintools.com/x2elon.space
https://whois.domaintools.com/m-poloniex.us
https://whois.domaintools.com/bittrex-global-on.com






Elon Musk Giveaway - is fake and no one gives double rewards after sending BTC, beware.

Poloniex is a phishing site pay attention to the URL.

Bittrex is the same as Poloniex a phishing site and pays attention to the URL again.

Better to bookmark the original site to your browser.

[$crypto$]

Trust Wallet Fake Wallet

Trust Wallet Fake Wallet

Code:

https://atomicwallet.dev/

Trust Wallet and Atomic Phishing

Website:

Code:

https://trust-wallet-app.xyz/
https://atomicwailet.io/

Info Domain

Created on 2021-07-17
Expires on 2022-07-17
Updated on 2021-07-17

73 days old
Created on 2021-05-05
Expires on 2022-05-05
Updated on 2021-07-04

Trust Wallet - This trick is still using the same no change at all however they have updated the domain today, and I think they have plenty of backup domains to create a phishing site.

Atomic - Still the same before but the domain must be considered again, the fraudsters always scamers in the spelling of the domain letters.

Keep your assets.

[Chikito]

Trust Wallet - This trick is still using the same no change at all however they have updated the domain today, and I think they have plenty of backup domains to create a phishing site.

A scammer just bought 1 server/VPS and create many domains (free) at the same time. this has been happening ever since this thread was created. which can be proven by the IP relationship with every site he created.

Just be careful when the website comes from those IPs, they could be trying to another way.

Code:

https://trust-wallet-app.xyz/

https://www.virustotal.com/gui/ip-address/104.21.78.15/relations

Found this

Code:

ethereum-code.me

Code:

https://atomicwailet.io/

https://www.virustotal.com/gui/ip-address/185.178.208.182/relations

Found this

Code:

www.itrustwallet.org

[CryptoYar]

blockchain wallet phishing website promoted through google ads.

website:

Code:

 https://login.blockcchalh.com/#/login

Interestingly if we try to access this website through PC, it looks something like this


It seems that scammers only targeting mobiles users.