[List] Phishing Cryptocurrency Site

[Baofeng]

Last couple of days:

Code:

 https://btcethpromo.info/
https://www.musk20.com/
https://teslagoods.info/
https://elonlive.com/
http://btcmusk.net/
https://muskpromo.cloud/
https://elonmuskgive.net/
https://4musk.top/
https://ethereum-eth.info/

Same images being used, sometimes it's tiring to hunt for this kind of phishing websites, but if you think the people you are going to save in this community by giving them warnings, it's worth in the end.

[Chikito]

Same images being used, sometimes it's tiring to hunt for this kind of phishing websites, but if you think the people you are going to save in this community by giving them warnings, it's worth in the end.

same like this, using fake medium and "double your crypto" scheme

Code:

https://eventcrypto.org/btc/
https://eventcrypto.org/
https://spacex.expert/eth/
https://spacex.expert/btc/
https://spacex.expert/
https://gatesgive.com/
https://eloncoin.info/eth/
https://eloncoin.info/btc/
https://eloncoin.info/
https://elonbtc.press/xrp/
https://elonbtc.press/eth/
https://elonbtc.press/btc/
https://elonbtc.press/
https://eventcrypto.net/eth/
https://eventcrypto.net/btc/
https://eventcrypto.net/
https://eventcrypto.me/
https://spacex.press/eth/
https://spacex.press/btc/

All reported and this not yet over, scammer every day trying to scam people by using fake and phishing give away, be careful.

[TravelMug]

Another Elon Musk fake giveaway

Code:

https://bitcoinelon.com/

Whois Record for BitCoinElon.com
How does this work?
Domain Profile
Registrant    Protection of Private Person
Registrant Country    ru
Registrar    Registrar of domain names REG.RU LLC REGISTRAR OF DOMAIN NAMES REG.RU LLC
IANA ID: 1606
URL: https://www.reg.com,https://www.reg.ru,http://www.reg.ru
Whois Server: whois.reg.com

(p)
Registrar Status    clientTransferProhibited
Dates    17 days old
Created on 2020-03-03
Expires on 2021-03-03
Updated on 2020-03-03    
 
Name Servers    NS1.REG.RU (has 1,502,646 domains)
NS2.REG.RU (has 1,502,646 domains)
   
 
Tech Contact    Protection of Private Person
PO box 87, REG.RU Protection Service,
Moscow, 123007, ru

(p) (f)
IP Address    194.58.112.174 - 175,467 other sites hosted on this server
   
 
IP Location    Russian Federation - Moskva - Moscow - Domain Names Registrar Reg.ru Ltd
ASN    Russian Federation AS197695 AS-REG, RU (registered Mar 28, 2011)
Domain Status    Registered And Active Website

https://www.virustotal.com/gui/ip-address/194.58.112.174/relations




BTC address:

Code:

36NxXedkXecvw9VbyGTUd4Fm9tMgpVHv3u

[Baofeng]

Cyber criminals attempt on QR code:

Code:

 http://bitcoin-barcode-generator.com/ 

archived: http://web.archive.org/save/http://bitcoin-barcode-generator.com/




archived: http://web.archive.org/save/http://btc-to-qr.com/

[Chikito]

Cyber criminals attempt on QR code:

Thanks for adding those scam.

I try using it and got different address generated



And was scanned, My address changed into scammer address 343CXYVBKXT2VgELCdjEeMyPpfiKwkzUNg.

We must be careful before using any Tool, be sure to always double check. because QR code as the results cannot be seen immediately.

[Baofeng]

Another new form of scam, I reported a similar theme/style from the scammers, [Scam]: Atomic wallet Complaint Form

Code:

PHISHING SITE: https://jaxx.live/

[Baofeng]

Another fake Elon Musk Giveaway:

Code:

 Phishing site: https://mdl3.top/

Registrar    Key Systems LLC
IANA ID: 1345
URL: http://www.key-systems.net
Whois Server: whois.rrpproxy.net

(p)
Registrar Status    clientTransferProhibited
Dates    20 days old
Created on 2020-03-07
Expires on 2021-03-07
Updated on 2020-03-26    
 
Name Servers    NS1.HOSTING.REG.RU (has 1,510,929 domains)
NS2.HOSTING.REG.RU (has 1,510,929 domains)
   
 
Tech Contact    —
IP Address    31.31.198.109 - 1,017 other sites hosted on this server
   
 
IP Location    Russian Federation - Moskva - Moscow - Domain Names Registrar Reg.ru Ltd
ASN    Russian Federation AS197695 AS-REG, RU (registered Mar 28, 2011)
Hosting History    5 changes on 3 unique name servers over 2 years

http://whois.domaintools.com/mdl3.top

[Baofeng]

( 1 ) Bitcoin doubler, I will assume that all transactions there are fake just to lure potential victims.

I also try to find the registered company, but so far I didn't get a hit so obviously, they wanted to look legit by having a company number but its all fake.

Code:

https://crypto-crown.ltd/

( 2 ) Another one:

Code:

https://bit-coinvestor.com/

[Chikito]

I also try to find the registered company, but so far I didn't get a hit so obviously, they wanted to look legit by having a company number but its all fake.

Code:

https://crypto-crown.ltd/

https://www.virustotal.com/gui/ip-address/193.233.15.195/relations
IP address 193.233.15.0
using Smart Telecom S.A.R.L office at Beirut > https://www.ripe.net/membership/indices/data/lb.smarttelecom.html

I am try to look up that's IP > https://ipinfo.io/AS51558, Still not find company name. just country, i am not sure about it.
https://ipinfo.io/193.233.15.195

Code:

City Cascade
Region Cascade
Coordinates -4.6667,55.5000
Timezone Indian/Mahe
Local Time April 01, 2020 | 04:02 PM
Country Seychelles

[Chikito]

Fake/Phishing Binance Promo Give away

Code:

http://binancepromo.com/

IP Address: 108.168.157.70
Detected as Malicious > https://www.virustotal.com/gui/ip-address/108.168.157.70/detection



Be careful..

[Baofeng]

Another list of fake giveaways:

Code:

http://ethventure.com/

Code:

Whois Record for EthVenture.com
 Domain Profile
IP Address	31.31.196.105 - 528 other sites hosted on this server
  
IP Location	Russian Federation - Moskva - Moscow - Domain Names Registrar Reg.ru Ltd
ASN	Russian Federation AS197695 (registered Mar 28, 2011)
Domain Status	Registered And Active Website
IP History	9 changes on 9 unique IP addresses over 2 years	  
Registrar History	2 registrars with 1 drop	  
Hosting History	7 changes on 7 unique name servers over 3 years	Hosting History 

http://whois.domaintools.com/ethventure.com

Code:

https://ethdrop.me/

Code:

Whois Record for EthDrop.me
 Domain Profile
Registrant Org	WhoisGuard, Inc.
Registrant Country	pa
Registrar	NameCheap, Inc.
IANA ID: 1068
URL: www.namecheap.com
Whois Server: whois.namecheap.com

(p)
Registrar Status	clientTransferProhibited, serverTransferProhibited
Dates	8 days old
Created on 2020-04-04
Expires on 2021-04-04
Updated on 2020-04-09	  
Name Servers	IGNAT.NS.CLOUDFLARE.COM (has 22,166,372 domains)
KINSLEY.NS.CLOUDFLARE.COM (has 22,166,372 domains)

http://whois.domaintools.com/ethdrop.me

[Chikito]

Another list of fake giveaways:

Code:

http://ethventure.com/

I found any related fake/phishing same IP : https://www.virustotal.com/gui/ip-address/31.31.196.105/relations

Code:

https://eth-ethereum.ltd/
www.bitkoinproject.ru

Code:

https://ethdrop.me/

related IP > https://www.virustotal.com/gui/ip-address/104.28.29.108/relations

Code:

http://wordcoin.online

We should ve careful and please report it > https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

[Baofeng]

Ethereum and Bitcoin generator scammer website. And obviously, the same people are behind.

(1)

Code:

http://ethereum.cryptogenerator.live/

(2)

Code:

http://bitcoin.cryptogenerator.live/

Code:

 Domain Profile
Registrant	REDACTED FOR PRIVACY
Registrant Org	Domain Protection Services, Inc.
Registrant Country	us
Registrar	Name.com, Inc.
IANA ID: 625
URL: http://www.name.com
Whois Server: whois.name.com

(p)
Registrar Status	autoRenewPeriod, clientTransferProhibited
Dates	383 days old
Created on 2019-04-01
Expires on 2021-04-01
Updated on 2020-04-09	  
Name Servers	NS8255.HOSTGATOR.COM (has 1,843,663 domains)
NS8256.HOSTGATOR.COM (has 1,843,663 domains)
  
Tech Contact	REDACTED FOR PRIVACY
REDACTED FOR PRIVACY,
REDACTED FOR PRIVACY, REDACTED FOR PRIVACY, REDACTED FOR PRIVACY, REDACTED FOR PRIVACY
(p) (f)
IP Address	91.195.240.94 - 305,971 other sites hosted on this server

http://whois.domaintools.com/cryptogenerator.live

[Chikito]

Again, Fake give away by fake Elon musk

Code:

https://promomusk.me/

A hundred transactions appear on the website using this address 1DZrNJ3V38x2VSHVk3yPT5gnyQRVZTujcC are fake, we can see address only have 2 real transactions.

[NotATether]

Ethereum and Bitcoin generator scammer website. And obviously, the same people are behind.

You know, I almost fell for one of these when I was a newbie. These kind of sites sucker in a lot of unsuspecting people.

I'm busy compiling the scam links in this thread into an adblocker filter.

[Baofeng]

Obvious fake XRP give-away, using Tumblr as the medium.

Code:

https://aprilcontest.tumblr.com/

[Baofeng]

Another Fake ETH giveaway:



Archived: http://web.archive.org/save/https://giveaway.revproject.site/

Code:

Whois Record for RevProject.site
 Domain Profile
Registrant Org	Privacy Protect, LLC (PrivacyProtect.org)
Registrant Country	us
Registrar	Beget LLC
IANA ID: 3806
URL: https://beget.com
Whois Server: whois.beget.com

(p)
Registrar Status	clientTransferProhibited, serverTransferProhibited
Dates	11 days old
Created on 2020-04-24
Expires on 2021-04-24
Updated on 2020-04-29	  
Name Servers	NS1.BEGET.COM (has 487,825 domains)
NS1.BEGET.PRO (has 91,047 domains)
NS2.BEGET.COM (has 487,825 domains)
NS2.BEGET.PRO (has 91,047 domains)
  
Tech Contact	—
IP Address	87.236.16.14 - 1,595 other sites hosted on this server[/quote]

http://whois.domaintools.com/revproject.site

[Chikito]

Another Fake ETH giveaway:
Archived: http://web.archive.org/save/https://giveaway.revproject.site/

Code:

IP Address	87.236.16.14

https://www.virustotal.com/gui/ip-address/87.236.16.14/relations



Seem that IP's has relationship with another fake/phising electrum wallet

Code:

http://www.electrumwallet.buzz/#home
http://www.walletelectrum.com/#home

archived1 and archived2



Be careful


Real Electrum is https://electrum.org

[Baofeng]

Here is another bitcoin generator, be careful we are approaching halving, maybe newbies think that they can simply earn free bitcoin.

Code:

http://bitgen.pro/

[Chikito]

Be aware fake Steve Wozniak Bitcoin Giveaway

Code:

https://telegra.ph/Steve-Wozniak-Foundation-15000-Bitcoin-Giveaway-Airdrop-05-10
http://wozniakbit.com

scammer wallet https://www.blockchain.com/btc/address/1EQaEux5fu7uTGkrDBR2RRARwbqDFMALPw still empty, no transaction.

Scammer IP relationship https://www.virustotal.com/gui/ip-address/107.150.102.158/relations

Code:

elonhelper.io

Domain/IP Information:

Code:

IP Address: 107.150.102.158
Domain Name: wozniakbit.com
Registry Domain ID: 2524219619_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.eranet.com
Registrar URL: http://www.eranet.com
Updated Date: 2020-05-11T05:58:48Z
Creation Date: 2020-05-10T08:14:42Z
Registry Expiry Date: 2021-05-10T08:14:42Z
Registrar: Eranet International Limited

Always be careful.