[List] Phishing Cryptocurrency Site

[Chikito]

Domain Name: KYC-METAMASK.IO
Registry Domain ID: D503300001201715023-LRMS
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2021-08-30T06:33:28Z
Creation Date: 2021-08-30T06:21:11Z
Registry Expiry Date: 2022-08-30T06:21:11Z
Registrar Registration Expiration Date:
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146

The domain from IP address : 34.102.136.180 which marked bad by every community on virus total, see this: https://www.virustotal.com/gui/ip-address/34.102.136.180/community called: Phishing distribution server, the scammer creates, Phishing, malicious, malware and etc. masquerade on  Amazon and another crypto site.

and, SSH bruteforce attack, also



let's report it to godday > abuse@godaddy.com

[Chikito]

Phishing axie infinity website

Code:

https://axieinfinity.monster/

IP Address: 172.67.194.217
Domain Name: AXIEINFINITY.MONSTER
Registry Domain ID: D247748994-CNIC
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: https://namecheap.com
Updated Date: 2021-08-29T13:13:53.0Z
Creation Date: 2021-08-29T12:16:57.0Z
Registry Expiry Date: 2022-08-29T23:59:59.0Z
Registrar: Namecheap

the IP relationship: https://www.virustotal.com/gui/ip-address/172.67.194.217/relations

the domain has created a month ago, that possible person who don't know the real game site can possible get the trap and write the detailed seed into phishing, they put the trap with a fool the broken metamask. Be carefull.

[$crypto$]

Pancakeswap Phishing Site

Website

Code:

https://pancake-swap.co/

Archived: https://archive.md/C4q9X

Domain Name: pancake-swap.co
Registry Domain ID: D2431850C211A4DD187AE420AF4DB121C-GDREG
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-09-03T18:48:23Z
Creation Date: 2021-08-29T18:48:22Z
Registry Expiry Date: 2022-08-29T18:48:22Z
Registrar: NameCheap, Inc.
Registrar IANA ID: 1068

FAKE: https://www.facebook.com/103144675449101/posts/103151822115053/

Don't ever click in this fake Facebook page, they are trying to create more phishing sites and spread on facebook and of course they should check the URL.

[$crypto$]

Phishing axie infinity website

Code:

https://axieinfinity.monster/

Phishing Axie Infinity Site

Website:

Code:

https://marketplaceaxiesinfinity.com/

Archived: https://archive.md/wip/TUoo9

Domain Name: MARKETPLACEAXIESINFINITY.COM
Registry Domain ID: 2638995766_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: www.publicdomainregistry.com
Updated Date: 2021-09-06T00:55:27Z
Creation Date: 2021-09-05T23:37:59Z
Registrar Registration Expiration Date: 2022-09-05T23:37:59Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303

FAKE: https://www.facebook.com/100961772285091/posts/129622502752351/

Maybe this phishing site is still related to what you found, I'm not surprised anymore when I continue to be on Facebook I always find things like this, I think everyone needs to be careful.
Even I now see so many streams from facebook about Axie Infinity game, please pay attention about this phishing site.

[Chikito]

Maybe this phishing site is still related to what you found, I'm not surprised anymore when I continue to be on Facebook I always find things like this, I think everyone needs to be careful.
Even I now see so many streams from facebook about Axie Infinity game, please pay attention about this phishing site.

maybe yes, but with a different server and IPs. Facebook and Twitter or Any social media are beautiful places for scammers to get into the trap because in those places too many people don't know how to distinguish real and fake.

like this one, I found it on Twitter

Code:

http://axieinfinity.tel

Same as above, that link directing to put the mnemonic seed.

IP Address: 104.21.90.27
Domain Name: axieinfinity.tel
Registry Domain ID: DE17E66F501AA4B2181E6A4632F423070-GDREG
Registrar WHOIS Server: whois.opensrs.net
Registrar URL: www.opensrs.com
Updated Date: 2021-09-10T22:00:10Z
Creation Date: 2021-09-10T21:52:07Z
Registry Expiry Date: 2022-09-10T21:52:07Z
Registrar: Tucows Domains Inc.

the relationship: https://www.virustotal.com/gui/ip-address/104.21.90.27/relations

[$crypto$]

Chipminxer Phishing

Website:

Code:

https://chipminxer.com/

Archived: https://archive.md/wip/Xr0kT

37 days old
Created on 2021-08-11
Expires on 2022-08-11
Updated on 2021-08-12

REAL


FAKE

[Chikito]

Chipminxer Phishing

Website:

Code:

https://chipminxer.com/

Archived: https://archive.md/wip/Xr0kT

I'm not surprised when comes from that popular site. when I checked, phishing sites using that name are increasing every day. A year ago, when I checked using a domain similar tool only about 100's, but now increased to be 250 with a similar Chipmixer name.

https://dnstwister.report/search?ed=636869706d697865722e636f6d

Some of the domains are still alive with the same interface as real a Chipmixer.

Code:

https://chipmlxer.com/

that impossible to stoping the scammer create a new one. but the owner can get an alert (by sign up), so when the scammer creates a similar domain, the owner can report quickly too; https://safebrowsing.google.com/safebrowsing/report_general/

[$crypto$]

Solana Fake Giveaway

Website:

Code:

https://get-sol.net/sol/

Archived: https://archive.ph/wip/Xcdok

Domain Name: GET-SOL.NET
Registry Domain ID: 2636323475_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.regtime.net
Registrar URL: http://www.webnames.ru
Updated Date: 2021-08-25T15:55:08Z
Creation Date: 2021-08-25T00:00:00Z
Registrar Registration Expiration Date: 2022-08-25T04:00:00Z
Registrar: REGTIME LTD.
Registrar IANA ID: 1362

This trick is still the same as other fake giveaways, but this time it is Solana who is indeed a trending topic, whichever is the increase, the scamers have created this scheme, I emphasize for beginners you have to be careful with this unreasonable offer.

Keep your money much safer.

[Baofeng]

Fake Sushi Swap:

Code:

https://sushi-app.com/

Archived: https://archive.is/bNuBS



Doman Info:

Dates    Created on 2021-09-22
Expires on 2022-09-21
Updated on 2021-09-21    
  
Name Servers    PNS41.CLOUDNS.NET (has 202,270 domains)
PNS42.CLOUDNS.NET (has 202,270 domains)
PNS43.CLOUDNS.NET (has 202,270 domains)
PNS44.CLOUDNS.NET (has 202,270 domains)
   
  
Tech Contact    REDACTED FOR PRIVACY
REDACTED FOR PRIVACY,
REDACTED FOR PRIVACY, REDACTED FOR PRIVACY, REDACTED FOR PRIVACY, REDACTED FOR PRIVACY
(p) (f)
IP Address    185.117.2.82 - -1 other site is hosted on this server

Just recently updated by the scammers, the real website is: https://sushi.com/.

So be careful on sites that you visited, as you might fall for this kind of tricks from scammers.

[$crypto$]

Solana Fake Giveaway

Website:

Code:

https://solana-donate.com/

Archived: https://archive.ph/OT4Fa

Domain Name: solana-donate.com
Registry Domain ID: 2635803775_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namesilo.com
Registrar URL: https://www.namesilo.com/
Updated Date: 2021-08-24T07:00:00Z
Creation Date: 2021-08-23T07:00:00Z
Registrar Registration Expiration Date: 2022-08-23T07:00:00Z
Registrar: NameSilo, LLC
Registrar IANA ID: 1479

Remember! this is just a fake giveaway and it has appeared before so beginners should stay alert don't be too greedy to want to take profit because this is a trap launched by scamers so beginners should know this thread because I will continue to update phishing/giveaway publish here.

[Chikito]

Phishing Exodus wallet still active until now, I don't know why the exodus team very slowly to take action, seems they don't have care about his customer.

Code:

https://exoduus.xyz

IP Address: 156.67.73.98
Domain Name: EXODUUS.XYZ
Registry Domain ID: D251530919-CNIC
Registrar WHOIS Server: whois.hostinger.com
Registrar URL: https://www.hostinger.com/
Updated Date: 2021-09-22T20:21:50.0Z
Creation Date: 2021-09-22T20:21:49.0Z

the relationship https://www.virustotal.com/gui/ip-address/156.67.73.98/relations

Code:

www.mooncake.website

[Kittygalore]

Phishing Exodus wallet still active until now, I don't know why the exodus team very slowly to take action, seems they don't have care about his customer.

Probably because they're benefiting from not taking action towards their issues, I mean if I was in that position, I'll try and make it as slow as possible if I know that I'm benefiting highly from that issue.

[Chikito]

Phishing Exodus wallet still active until now, I don't know why the exodus team very slowly to take action, seems they don't have care about his customer.

Probably because they're benefiting from not taking action towards their issues, I mean if I was in that position, I'll try and make it as slow as possible if I know that I'm benefiting highly from that issue.

playing with fire, when they can not handle it, will burn them themselves and company.

that way is very different from others, another developer wallet always warn to do not traped the phishing site every time.

I'm not interested to use the wallet when they never oversight and or take any action, that is very dangerous, the original could be also easy to infiltrate, who is knows?.

[Chikito]

Fake-Phishing minttswap

Code:

http://minttswap.com/

this is the fake way to manage all your wallets from a single app (phishing trap)

IP Address: 143.198.57.27
Domain Name: MINTTSWAP.COM
Registry Domain ID: 2644270917_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namesilo.com
Registrar URL: http://www.namesilo.com
Updated Date: 2021-09-28T19:03:15Z
Creation Date: 2021-09-28T19:00:36Z
Registry Expiry Date: 2022-09-28T19:00:36Z
Registrar: NameSilo, LLC
Registrar IANA ID: 1479
Registrar Abuse Contact Email: abuse@namesilo.com
Registrar Abuse Contact Phone: +1.4805240066
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: NS1.DIGITALOCEAN.COM
Name Server: NS2.DIGITALOCEAN.COM

The relationship with another phishing: https://www.virustotal.com/gui/ip-address/143.198.57.27/relations

Code:

pancakeswaap.net
synchronizewalet.net
synchronizewalet.org

[Baofeng]

Fake Opensea market website:

Code:

https://opènsea.net/wallet/page.html

Archive: https://archive.is/3HYSD

It is very similar to the original site, thus making it very dangerous for inexperienced users. Don't connect your wallet to this site as you will obviously gets hack and lose your precious coins.

Registrant    Withheld for Privacy Purposes
Registrant Org    Privacy service provided by Withheld for Privacy ehf
Registrant Country    is
Registrar    NAMECHEAP INC NameCheap, Inc.
IANA ID: 1068
URL: http://www.namecheap.com
Whois Server: whois.namecheap.com

(p)
Registrar Status    addPeriod, clientTransferProhibited
Dates    29 days old
Created on 2021-09-02
Expires on 2022-09-02
Updated on 0000-12-31    
 
Name Servers    DNS1.REGISTRAR-SERVERS.COM (has 7,669,646 domains)
DNS2.REGISTRAR-SERVERS.COM (has 7,669,646 domains)
   
 
Tech Contact    Withheld for Privacy Purposes
Privacy service provided by Withheld for Privacy ehf
Kalkofnsvegur 2,
Reykjavik, Capital Region, 101, is

(p)
IP Address    206.188.196.8 is hosted on a dedicated server
   
 
IP Location    United States - Wyoming - Sheridan - Bl Networks
ASN    United States AS399629 BLNWX, US (registered Apr 30, 2021)
Domain Status    Never Registered Before
IP History    1 change on 1 unique IP addresses over 0 years    
 
Hosting History    1 change on 2 unique name servers over 0 year

[Chikito]

Fake and Phishing validatewallet.tech

Code:

http://www.validatewallet.tech

IP Address: 169.255.59.10
Domain Name: VALIDATEWALLET.TECH
Registry Domain ID: D252536369-CNIC
Registrar WHOIS Server: whois.web4africa.net
Registrar URL: https://web4africa.com
Updated Date: 2021-09-30T04:14:30.0Z
Creation Date: 2021-09-30T04:14:29.0Z
Registry Expiry Date: 2022-09-30T23:59:59.0Z
Registrar: Web4Africa Ltd.
Registrar IANA ID: 664

The IP relationship: https://www.virustotal.com/gui/ip-address/169.255.59.10/relations

Code:

www.walletvalidators.com
www.tokenrelease.net
www.coinxpad.xyz
pancakeswap.coinxpad.xyz
www.trust-wallet.live

......

more ....Fake..

Scammer trying to create fake sync wallet to dapps. After connected, the scammer asking a seed and private key and stolen all token inside the wallet.

[$crypto$]

Ranger Protocol fake sale

Website:

Code:

https://polkastarter.sa.com/rangersprotocol
https://www.bscpad.ca/project/RangersProtocol

That Rangers Protocol will start IDO on Polkastarter on 7 October.
This is the announcement.: https://twitter.com/rangersprotocol/status/1445032666655600645
As an official IDO: https://www.polkastarter.com/projects/rangers-protocol


Fake Polkastarter

Website:

Code:

https://polkastarter.direct/

Archived: https://archive.ph/wip/oZivj

12 days old
Created on 2021-09-22
Expires on 2022-09-22
Updated on 2021-09-27

In terms of appearance, it is slightly different and the official one uses a black background, while the phishing one uses a white background.
You have to distinguish between easy things.

The official website: https://www.polkastarter.com/

[$crypto$]

Ethereum Fake Giveaway

Website:

Code:

https://mediumn.us/eth/index.html

Archived: https://archive.ph/9TYW9

Domain Name: mediumn.us
Registry Domain ID: D2B0D73284CE84239AF407BD0DE018F8C-GDREG
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2021-10-05T08:47:56Z
Creation Date: 2021-09-30T08:47:56Z
Registry Expiry Date: 2022-09-30T08:47:56Z
Registrar: NameCheap, Inc.
Registrar IANA ID: 1068
Registrar Abuse Contact Email:

Scammers spread on Facebook to be careful and never follow this offer wherever you find it clearly this Giveaway is a fake.

I'll be posting here often if I find anything else about scamers on facebook.

Be careful.

FAKE: https://www.facebook.com/103440387917736/posts/386254322969673/

[$crypto$]

Huobi Team Fake Giveaway

Website:

Code:

https://medium.huobi-giveaway.net/

Archived: https://archive.ph/wip/aS8Lt

Domain Name: huobi-giveaway.net
Registry Domain ID: 2643880090_DOMAIN_NET-VRSN
Registrar WHOIS Server: whois.registrar.eu
Registrar URL: http://www.registrar.eu
Updated Date: 2021-09-27T22:47:21Z
Creation Date: 2021-09-27T12:34:00Z
Registrar Registration Expiration Date: 2022-09-27T12:34:00Z
Registrar: Hosting Concepts B.V. d/b/a Registrar.eu
Registrar IANA ID: 1647

Back again, something like this is on Telegram, so if you already know it's better to go out and block it because this will definitely be added automatically by bots, so stay alert for classic tricks like this.

[$crypto$]

Shiba INU Phishing Site

Website:

Code:

http://shiba-inu.site/

Archived: https://archive.ph/Cvy6E

[/quote]
Domain Name: SHIBA-INU.SITE
Registry Domain ID: D250518249-CNIC
Registrar WHOIS Server: whois.webnic.cc
Registrar URL: http://www.webnic.cc
Updated Date: 2021-10-02T01:43:38.0Z
Creation Date: 2021-09-15T12:06:23.0Z
Registry Expiry Date: 2022-09-15T23:59:59.0Z
Registrar: Web Commerce Communications Ltd
Registrar IANA ID: 460
[/quote]



Because Shiba INU's pumping has increased significantly so more scamers will take advantage of this situation, so be careful because more sites will be spread about Shiba INU because they want to take your money when entering Seed/phrases.