[List] Phishing Cryptocurrency Site

[$crypto$]

Exodus Phishing Wallet

Website:

Code:

https://exoduxs.com/

Archived: https://archive.is/wip/fIDv4

1 days old
Created on 2021-07-21
Expires on 2022-07-21
Updated on 2021-07-21

A scammer just bought 1 server/VPS and create many domains (free) at the same time. this has been happening ever since this thread was created. which can be proven by the IP relationship with every site he created.

Just be careful when the website comes from those IPs, they could be trying to another way.

Possibly this is also the same thing with scamers who have created free domains from free servers/VPS and it seems this might be an easier trick to get more domains.

[CryptoYar]

WalletConnect phishing website.


Website link:

Code:

https://www.livewallet-connect.site/

Archive: https://archive.vn/ZDZIE

Domain info.

4 days old
Created on 2021-07-18
Expires on 2022-07-18
Updated on 2021-07-18

Domain names on the same IP address:

Code:

www.livewallet-connect.site
www.capitalasia.postalswiftdelivery.com
capitalasia.postalswiftdelivery.com
groups-pnc.com
walletextention.com
livewallet-connect.site
cryptwalletconnect.com
walletsynchronizations.live
amakaclarafoundation.org
fortisonline.online
sxriuzi.com
seacroneglobal.com
savvykulture.com
laughinggoatlagos.com
enochxchange.com

[Chikito]

Possibly this is also the same thing with scamers who have created free domains from free servers/VPS and it seems this might be an easier trick to get more domains.

sure, there are many vouches for free VPS and domain that possibility the scammer create the phishing site only one day.


@mole0815 can post it here.

Again, Phishing Chipmixer

Code:

https://chipmixẹr.com

Code:

https://xn--chipmixr-z30d.com

Where I found it?, google searching.

Domain Name: chipmixẹr.com
IP Address: 162.213.251.90
Domain Name: XN--CHIPMIXR-Z30D.COM
Registry Domain ID: 2518953138_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-04-01T08:02:34Z
Creation Date: 2020-04-26T15:22:12Z
Registry Expiry Date: 2022-04-26T15:22:12Z

The IP's relationship. https://www.virustotal.com/gui/ip-address/162.213.251.90/relations

Code:

https://exellentinvest.com/
https://todaycoin.club/

[$crypto$]

@mole0815 can post it here.

Again, Phishing Chipmixer

Where I found it?, google searching.

I also found a fake review about Chipmixer and even that is the same as what you just said, it seems this review has been around since 9-09-2020 was published.

The scammers actually insert their phishing sites in their original writings, if they don't look carefully, of course this will be a trap too.

https://bitcoin2.biz/mixer/7-chipmixer-review.html Fake review

Onion URL: https://chipmixerwzxtzbw.online/ Fake



The URL writing looks real but when clicked or copied the URL will be different.


Kraken Phishing Site

Website:

Code:

https://kraken-yb.com/sing-in/sign-in/us-home/
https://kraken-zp.com/sing-in/sign-in/us-home/

Archived: https://archive.is/hIRiV

Kraken-zp.com

1 days old
Created on 2021-07-22
Expires on 2022-07-22
Updated on 0000-12-31

Kraken-Yb.com

5 days old
Created on 2021-07-18
Expires on 2022-07-18
Updated on 0000-12-31

The display at login is the same there is no difference but we have to check the URL clearly and it is very different.

So they created the same 2 phishing sites.

When I wanted to open the Kraken site and do a search, it turned out that there was a phishing site that was tucked into the first page of Google search.

[moderator's note: consecutive posts merged]

[CryptoYar]

Another bitcoin & ethereum fake giveaway

website Link:

Code:

https://eventbyether.org
https://eventbyether.org/btc/
https://eventbyether.org/eth

Archive

   1 days old
Created on 2021-07-25
Expires on 2022-07-25
Updated on 2021-07-25

Wallet addresses:

Code:

Btc: 17fSZdSZMPXE4qcVENAYECk8WqwJC77yR5
Eth: 0x7f3e8fe83ED1024a50d9936A974306D5eD130Db3

[$crypto$]

Shibaswap Phishing Site

Website:

Code:

https://www.shibaswap.pw/

Archived: https://web.archive.org/web/20210726195819/https://www.shibaswap.pw/

Domain Name: SHIBASWAP.PW
Registry Domain ID: D239117758-CNIC
Registrar WHOIS Server: whois.joker.com
Registrar URL: http://joker.com
Updated Date: 2021-06-23T21:43:41.0Z
Creation Date: 2021-06-14T21:22:33.0Z
Registry Expiry Date: 2022-06-14T23:59:59.0Z
Registrar: CSL Computer Service Langenbach GmbH
Registrar IANA ID: 113

https://www.facebook.com/permalink.php?story_fbid=111089124597542&id=102901985416256

Phishing has appeared on my Facebook homepage and now they have more and more fake pages and the now I've been trying to report it, the more people report it the sooner it will be killed

Keep checking back especially for newbies who just see this on your Facebook.

SWAP official website: https://shibaswap.com/

[$crypto$]

wallectconnect.com Phishing

Website:

Code:

https://wallectconnect.com/

Archived: https://archive.is/tYEEH

Domain name: wallectconnect.com
Registry Domain ID: 2603139687_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 0001-01-01T00:00:00.00Z
Creation Date: 2021-04-06T08:34:13.00Z
Registrar Registration Expiration Date: 2022-04-06T08:34:13.00Z
Registrar: NAMECHEAP INC
Registrar IANA ID: 1068

Official site: https://walletconnect.org/

Always avoid phishing sites and pay attention to the URL if it's better then you have to save it in bookmarks

[Chikito]

Phishing Uniswap

Code:

http://app.uniswap.org.airdrop-holders-liquidity.com

scammer trying to trap the user with false connects with metamask to get the mnemonic seed.

IP Address: 192.99.170.97
domain Name: app.uniswap.org.airdrop-holders-liquidity.com

https://www.virustotal.com/gui/ip-address/192.99.170.97/relations


Also, be aware of fake google ads bitcoin core

Code:

https://www.biltucoin.org/

[$crypto$]

Pancakeswap Phishing Site

Website:

Code:

https://pancakeios.com/

Archived: https://web.archive.org/web/20210803160334/https://pancakeios.com/

1 days old
Created on 2021-08-02
Expires on 2022-08-02
Updated on 0000-12-31

This phishing site ad is being promoted on the sponsor's Facebook page and I think there will be more to it than that.
So we never click from unknown pages and try to pay attention to the URL when visiting it.

[Chikito]

Phishing Metamask Wallet

Code:

connectmetamaks.com

IP Address: 198.54.126.105
omain Name: connectmetamaks.com

Top Level Domain: COM (Commercial TLD)

Domain Name: CONNECTMETAMAKS.COM
Registry Domain ID: 2631666767_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-08-05T10:41:54Z
Creation Date: 2021-08-05T10:41:29Z
Registry Expiry Date: 2022-08-05T10:41:29Z

Be careful that IP address and domain has correlated with another scam and phishing, you can check it here > https://www.virustotal.com/gui/ip-address/198.54.126.105/relations



that habit can't be erased, once he scammer will be forever, he just changes the domain with the same trick. just be careful, they are around us.

[$crypto$]

Pancakeswap Phishing Site

Website:

Code:

https://pancakeaps.finance/

Archived: https://archive.is/wip/akO2W

Domain Name: pancakeaps.finance
Registry Domain ID: e61813cd5d2c4d949111211b9a7d81f5-DONUTS
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: https://www.namecheap.com/
Updated Date: 2021-08-09T09:25:50Z
Creation Date: 2021-08-09T09:23:54Z
Registry Expiry Date: 2022-08-09T09:23:54Z
Registrar: NameCheap, Inc.
Registrar IANA ID: 1068

I see almost every day phishing is always there, and this afternoon I found the Pancakeswap phishing site with a different name now and the one that was not accessible anymore, so it's true these scamers have changed the name a lot to fool beginners who don't even know the script no difference at all.

It's much better to bookmark the original URL than having to type it if you can't tell the difference.

But I'm sure there must be people trapped outside the forum.

[$crypto$]

Binance Giveaway Fake

Website:

Code:

https://bince-x2x3bonus.com/

Archived: https://web.archive.org/web/20210816132421/https://bince-x2x3bonus.com/

Domain Name: bince-x2x3bonus.com
Registry Domain ID: 2633563772_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.registrar.eu
Registrar URL: http://www.registrar.eu
Updated Date: 2021-08-13T12:52:57Z
Creation Date: 2021-08-13T10:52:45Z
Registrar Registration Expiration Date: 2022-08-13T10:52:45Z
Registrar: Hosting Concepts B.V. d/b/a Registrar.eu
Registrar IANA ID: 1647

Fake giveaways have appeared again and they have added a lot of members on the telegram channel, so for beginners who just know please be careful never to send any funds offered by them on telegram.

[CryptoYar]

Fake BTC and Eth Giveaway

Website:

Code:

https://elon-musk2021.com/

Archived: https://archive.vn/Ue4ac

Domain info:
   

1 days old
Created on 2021-08-17
Expires on 2022-08-17
Updated on 2021-08-17

Scammers promoting this website on YouTube along with a video clip of the bitcoinword conference.

Video link: https://youtu.be/KYdm5mzd2Mk

Scammers wallets:

Code:

Btc: 0xE09Ac45DE32feD3489e8891d22dD6EA9FdEFCA64
Eth: 0xE09Ac45DE32feD3489e8891d22dD6EA9FdEFCA64

[$crypto$]

Walletconnet Phishing Site:

Website:

Code:

https://waletconnector.com/

Archived: https://archive.ph/wip/29wgA

Domain Name: waletconnector.com
Registry Domain ID: 2603389585_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.registrar.eu
Registrar URL: http://www.registrar.eu
Updated Date: 2021-04-07T07:44:12Z
Creation Date: 2021-04-07T05:42:13Z
Registrar Registration Expiration Date: 2022-04-07T05:42:13Z
Registrar: Hosting Concepts B.V. d/b/a Registrar.eu
Registrar IANA ID: 1647

There is no difference the script remains the same and it seems like scamers continue to use this script but they only change in terms of the spelling of the domain, and this is the most important thing to pay attention to.

stay alert.

[$crypto$]

Two TrustWallet phishing sites

Website:

Code:

https://titrustwallat.com/
https://trustlivewallet.com/

Archived:
https://archive.ph/LdcJi
https://archive.ph/wip/5afJ6

Created on 2021-08-27
Expires on 2022-08-27
Updated on 2021-08-27

92 days old
Created on 2021-05-27
Expires on 2022-05-27
Updated on 2021-06-15

Phishing sites always ask for your phrase to be entered into the site so, beginners should be careful and look at the URL again and distinguish it from the original, because a group of scamers now have a lot of advertising on Facebook that almost resembles the original page.

[Ultegra134]

I don't get how I fell for such a scam, when there's even a thread about it right here. (I was just informed by another user about this thread). I don't get why I didn't look it up earlier before conducting such a stupid move. Anyway, do not trust anyone on Discord, and keep in mind that project officials/admins will NEVER DM you.

This was a lesson for me, I almost lost all the money I was talking about in my Bitcointalk appreciation thread (https://bitcointalk.org/index.php?topic=5356169). It would suck big time if now I made a thread "How I lost all my money".

The website I'm referring to is the following:

Code:

Website: https://multibridge-dapps.com/

Archive: http://web.archive.org/web/20210831175418/https://multibridge-dapps.com/

I put my private key there, because it wouldn't automatically "authorize". What a dumbass I am. Fortunately, my gut instinct kicked in and the very next second I did that stupid move, I moved all my funds to another wallet.

Be safe, do not trust anyone and never input any confidential information EVER!

[Chikito]

I put my private key there, because it wouldn't automatically "authorize". What a dumbass I am. Fortunately, my gut instinct kicked in and the very next second I did that stupid move, I moved all my funds to another wallet.

Be safe, do not trust anyone and never input any confidential information EVER!

You have to edit that link to unclickable to avoid another user access it

Code:

https://multibridge-dapps.com/

that could be a lesson for you and everyone to recheck and always learning in the next time.

the website was created 14 days ago which purposes for the scam.

IP: 198.187.31.167
Domain Name: MULTIBRIDGE-DAPPS.COM
Registry Domain ID: 2633753046_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-08-14T17:47:29Z
Creation Date: 2021-08-14T17:33:13Z

the scammer usually uses the same server and IP address to create another one.

See the related IP: https://www.virustotal.com/gui/ip-address/198.187.31.167/relations

Code:

https://www.safemoonmaxsfax.com/
www.coinlitefx.com
https://www.coin-star.net/

...etc

the scammer creates another way when failed on the first step, just to look at what they create, token, exchange, cloud mining and etc.

[Ultegra134]

I put my private key there, because it wouldn't automatically "authorize". What a dumbass I am. Fortunately, my gut instinct kicked in and the very next second I did that stupid move, I moved all my funds to another wallet.

Be safe, do not trust anyone and never input any confidential information EVER!

You have to edit that link to unclickable to avoid another user access it

Code:

https://multibridge-dapps.com/

that could be a lesson for you and everyone to recheck and always learning in the next time.

the website was created 14 days ago which purposes for the scam.

IP: 198.187.31.167
Domain Name: MULTIBRIDGE-DAPPS.COM
Registry Domain ID: 2633753046_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-08-14T17:47:29Z
Creation Date: 2021-08-14T17:33:13Z

the scammer usually uses the same server and IP address to create another one.

See the related IP: https://www.virustotal.com/gui/ip-address/198.187.31.167/relations

Code:

https://www.safemoonmaxsfax.com/
www.coinlitefx.com
https://www.coin-star.net/

...etc

the scammer creates another way when failed on the first step, just to look at what they create, token, exchange, cloud mining and etc.

Alright, changed it. It was definitely a lesson learned, I'm not responding to any messages I receive from unknown people nor am I going to give out such information ever again.

I was one of the lucky ones, that at least immediately realized what a stupid thing I've done.

[$crypto$]

Exodus Site Phishing

Website:

Code:

https://crypto-bonus.top/

Archived: https://archive.ph/wip/aFYPB

Domain Name: crypto-bonus.top
Registry Domain ID: D20210904G10001G_68339676-top
Registrar WHOIS Server: whois.namesilo.com
Registrar URL: https://www.namesilo.com
Updated Date: 2021-09-03T18:47:03Z
Creation Date: 2021-09-03T18:43:40Z
Registry Expiry Date: 2022-09-03T18:43:40Z
Registrar: NameSilo,LLC
Registrar IANA ID: 1479

FAKE: https://www.facebook.com/permalink.php?story_fbid=108800091537768&id=108797548204689

There have been many fake sites with ads on Facebook, so if you don't know, especially beginners, don't click on anything because the promotion always offers a bonus that is supposed to include a phrase/seed.

The point is to avoid this.

[$crypto$]

Metamask Site Phishing

Website:

Code:

https://www.kyc-metamask.io/

Archived: https://archive.ph/wip/LOnzv

Domain Name: KYC-METAMASK.IO
Registry Domain ID: D503300001201715023-LRMS
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2021-08-30T06:33:28Z
Creation Date: 2021-08-30T06:21:11Z
Registry Expiry Date: 2022-08-30T06:21:11Z
Registrar Registration Expiration Date:
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146

FAKE: https://www.facebook.com/permalink.php?story_fbid=111449014596773&id=108198504921824

Like my post a few hours ago, when I surf on Facebook I always find fake pages like this that are always worrying about other people who don't know anything, so don't ever click on a page on Facebook if you don't know anything.