[List] Phishing Cryptocurrency Site

[Chikito]

Updated 16 December 2021

New Phishing

Phishing Trust Wallet


Old Post

Old Post

- Fake Optimism.io website
- Chipmixer.com.mx Phishing
- Shiba INU Phishing Site
- Fake Facebook Ethereum Giveaway
- Chipminxer Phishing
- Phishing axie infinity website
- Metamask Site Phishing
- Phishing chipmixẹr.com
- Phishing exodus.ac wallet
- Phishing pancakeswap.cheap
- Phishing Chipmixer on Review Website
- Fake Give Away 1inch.gift
- Phishing Walletconnection.org
- Phishing uniswap-meta Wallet
- Wilder World Fake Public Sale
- Fake Chipmixer.co.uk (chipmixkd2wgbqoy.onion)
- Phishing Exodus Wallet
- Phishing Myetherwallet
- FAKE Trezor Wallet
- Fake Electrum Wallet
- Scam walletinterlink.com
- Web Phishing Trezor
- Fake Myetherwallet and Uniswap
- Scam/Phishing validatewebwallets.online
- Phishing BestChange (bestchainge.club)
- Fake Exodus wallet
- Fake walletconnect.org
- Fake Uniswap (uinswop)
- Phishing Paxful Exchange
- Fake Elon Musk giveaway
- Fake Mycelium wallet on Android
- Phishing Uniswap
- Fake Binance Airdrop
- Phishing [coingecko.pro exchange]
- [uni-airdrop.org and bit2x.uno]
- [https://elonmuskxpro.com/]
- [https://money-tesla.com/]
- [https://uniswap.eth.link/]
- [Fake musk-coins.com]
- [Chipmixer Onion Link]
- [uni-drop.com]
- [uniswcp.org and justswapv2.com]
- [binancezh.com and uniswapz.org]
- Unireward and Unii.finance
- coin-ex.ru and besetchange.ru
- Uniswap.ug and https://socialbtc.org/
- https://uniswapv.com/
- https://ripplelab.in
- https://bledner.io/
- http://drop-eth.org/
- https://binancefound.com/
- exiodus.com
- https://bin-crypto.com/
- https://supportbnb.com/
- https://vitalikbb.top/
- https://autopoolcrypto.com/
- https://spacex-btc.biz/
- https://myetherwallet.com-to-the-access.com/index.php?
- https://tslahelp.me/
- https://2ethereum.org/
- http://Giveaway.is
- https://muskx.co/
- https://elonpromo.org/
- https://guadra.com
- https://clowallet.network/
- http://paxfuloffers.com/
- https://myfusionwallet.net/
- http://jaxxx.io/
- www.chambtc.us
- http://ethventure.com/
- http://bitcoin-barcode-generator.com/
- https://bitcoinelon.com/
- blendér.io
- https://donaldcrypto.com/
- https://www.free-ether.com/
- smatmixer.io
- https://lrezor.io/
- https://eth-giveout.com/
- www.treezor.io
- http://muetherewallet.com/
- https://exmo.me/
- locabicoins.net
- btnance.org
- monnero.org


Beginners and newbie should be careful about the phishing website. A lot of Scammers out there used a fake website to steal your Bitcoin and Cryptocurrency.

Read 5 Ways to Identify a Phishing Website and Read [GUIDE] Use this for identifying Scam/Phishing Websites & Exchanges in Crypto

On this thread, I want to share what we found out there.

For Example

1. Phishing exodus website: //exodlus.io



When scanning virus total has warned:
https://www.virustotal.com/gui/url/8bb6a4ef386b9c29d2cc00509aa3a44ec7d7dbf792f057074ad0ec471d8611e9/detection
BitDefender-Phishing

Flagged Ip address 185.212.130.65

Related IP

2. Fake electrum site : electum.org

[1715550884]

1715550884

[1715550884]

1715550884

[1715550884]

1715550884

[yazher]

Be careful to beginner and newbie checking twice before doing something

The site looks legit when you first see it, Thankfully we have this thing called "virus total" who can scan sites that used for phishing.
We to be careful about logging in on some wallets website Address. these are prone to this kind of attack. I saw someone who is nearly scam by this method. He got an offer from some unknown user, and they gave them a look-alike of their exchange site. then he was asked for his log-in exchange ID. Thankfully he was quick to manage to figure out that the site was not real and it was indeed a phishing site. Just like this one.

[Chikito]

I see that IP address related to localbitcoinis.net

Code:

2019-10-30-exodlus.io
2019-10-27-localbitcoinis.net
2019-10-27-liocalbitcoins.net
2019-10-27-llocalbitcoins.net
2019-10-27-localbitcolins.net
2019-10-27-loca1bitcoins.net
2019-10-27-iocalbitcoins.net
2019-10-27-localibitcoins.ru.com
2019-10-27-localbitcolns.org
2019-10-27-localbitcoln.ru
2019-10-27-ilocalbitcoins.net
2019-10-27-loca1bitcoins.com
2019-10-27-nicelhash.com
2019-10-27-mlnergate.com
2019-10-27-msl-afterburner.ru
2019-10-27-iocabitcoins.net
2019-10-27-iocalbitcolns.net
2019-10-27-localbiicoins.net
2019-10-27-litecoln.org
2019-10-26-locaibitcolns.com

Still same Flagged Ip address 185.212.130.65

This

guimlner.org
minergate.ru.com
monnero.org

Fake : guimlner.org



Fake : minergate.ru.com



Fake: monnero.org

[Krislaw]

https://www.electum.org/#download

Clicked Standalone Executable and windows installer
https://download.electrum.org/3.3.8/electrum-3.3.8.exe
https://download.electrum.org/3.3.8/electrum-3.3.8-setup.exe
is it direct to a true site?

[barnes13]

https://www.electum.org/#download

Clicked Standalone Executable and windows installer
https://download.electrum.org/3.3.8/electrum-3.3.8.exe
https://download.electrum.org/3.3.8/electrum-3.3.8-setup.exe
is it direct to a true site?

Well, this is what makes me wonder. If the fake website directs the download link to the electrum original site, what benefits can he get from this? Do you think that the crime he committed hasn't been perfect? I think that he can now use the original link and in the future the link can turn into a program that he has inserted a virus in?

[Lucius]

From Russia with love and desire for you coins

What anyone can do is report these pages on the following link : https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

With more reports sites will be blocked in most browsers (Chrome&Firefox), and also by some security software. It is the most effective way to protect all those who could become potential victims, and it takes just a few minutes of your time. I did my part, let's block them as soon as possible.

[Chikito]

I think that he can now use the original link and in the future, the link can turn into a program that he has inserted a virus in?

Maybe Next when a lot of people trust fake site Scammer prepares to inject a virus, Fake electrum looks clean from virus atm.
When looking at fake exodus site I found a lot of phishing
https://www.virustotal.com/gui/url/8bb6a4ef386b9c29d2cc00509aa3a44ec7d7dbf792f057074ad0ec471d8611e9/detection

[barnes13]

<…> If the fake website directs the download link to the electrum original site, what benefits can he get from this? Do you think that the crime he committed hasn't been perfect? I think that he can now use the original link and in the future the link can turn into a program that he has inserted a virus in?

The download links do not point to the original proper files (at least not now). Both download options (windows and Mac OS) point to the same file, which is already detected as a phishing file:
https://www.virustotal.com/gui/url/96eb2fe1512ef9c7b08b13b6b4f7e1f01671f122c572188978775379741165ce/detection

If the fake website from Exodus I can clearly see they put phishing on the program, but have you seen the fake website from Electrum? The link to download the file provided is exactly the same as the one on the original Electrum website: https://www.virustotal.com/gui/url/ba31287b8adf984730d6ff37f414e165d61dac7f3cb226b967d48262931fab48/detection

[JeromeTash]

If the fake website from Exodus I can clearly see they put phishing on the program, but have you seen the fake website from Electrum? The link to download the file provided is exactly the same as the one on the original Electrum website: https://www.virustotal.com/gui/url/ba31287b8adf984730d6ff37f414e165d61dac7f3cb226b967d48262931fab48/detection

There is a also a possibility that they are still updating their website. If you look at the domain information, the domain is newly registered. Perhaps they are still planning to include their malicious files soon.

It's good that OP discovered the  phishing sites very early.

[DdmrDdmr]

<...>

Yes, you're right. I just did a side by side comparison on all the links and they all seem to be original so far. It’s likely that they created the page ahead of the development as @JeromeTash suggests, and were discovered sooner that they expected.

[barnes13]

Maybe I want to give some advice to you if you find a site like that, we can report it via Google or Yahoo.

The steps to report it through Google are very easy:
Step 1: Go to page: https://safebrowsing.google.com/safebrowsing/report_badware/

Step 2: Write the URL that is suspected as fake or scam website

Step 3: You can write additional details about the website and explain it in the space provided

Step 4: Click "submit report" and Google will investigate it.

Steps to report via Yahoo you can see it by visiting this link: https://safety.yahoo.com/MY/Security/REPORTING-SECURITY-ISSUES-MY.html

[Lafu]

Looks like there is now again some wave of phishing sites like it was last year at some point .

Always read the Name in the adress field and check it a few times before you enter or connect to the webpage , Wallet or anything !
Also check a few times what you downloading or doing when you have to insert your password and Login details .

I cant say it often enough !  Check everything 2 times or more when you Login in something   specialy when money or crypto is involved !

Its your money and Coins

[Chikito]

https://safebrowsing.google.com/safebrowsing/report_badware/
https://safety.yahoo.com/MY/Security/REPORTING-SECURITY-ISSUES-MY.html

When we look at the history Scammer always changes the domain.
Scammer always changes it into another fake website.
I am ready to report that IP address here https://www.abuseipdb.com/
Still, don't know what the best place to report IP address like your both link

[notblox1]

Thanks for warning us!

Looks like this is some kind of bad Russian only version of exodus phishing.
I reported it also...so let's hope they will take it down soon.

[erickastella]

thank you very much my brother with this I can avoid phishing very much, I am very helped by this post, thank you very much for sharing the information my friend
I also have a suggestion that there is an antivirus called ESET antivirus which is very powerful because it can detect phishing and other websites.

[Chikito]

Found Fake MyEtherwallet:  myetherewallet.info

Code:

Domain Name: WWW-MYETHEREWALLET.INFO
Registry Domain ID: D503300001182102047-LRMS
Registrar WHOIS Server: whois.reg.com
Registrar URL: http://www.reg.com
Updated Date: 2019-10-27T13:00:27Z
Creation Date: 2019-10-26T20:28:05Z
Registry Expiry Date: 2020-10-26T20:28:05Z
Registrar Registration Expiration Date:
Registrar: Limited Liability Company "Registrar of domain names REG.RU"
Registrar IANA ID: 1606
Registrar Abuse Contact Email: abuse@reg.ru
Registrar Abuse Contact Phone: +7.4955801111

https://www.virustotal.com/gui/url/c214a72e293e3f54dd2af812cf1f53c19656a4a61c9cc4436963204483ee2d89/detection



Related with: https://www.virustotal.com/gui/ip-address/194.58.112.174/relations

Code:

myelherewallut.com
myeihereswallet.com
muetherewallet.com
myeiherwollet.com
myelherewallets.com

[SabrinaCane]

OHMYDAYS thanks for the warning! I have just had a call from this number that offered to sell me bitcoin and told me to go to this webpage!! I told him I had to check it over first and give him a call back and stumbled across this  https://scam-numbers.co.uk/Number/0031858888229/ and also this post so thanks guys! Seems to be a scam for sure! If anyone can point me in the direction of a legitimate seller that would be grand! Thanks, Sabrina x

[panganib999]

I think that he can now use the original link and in the future, the link can turn into a program that he has inserted a virus in?

Maybe Next when a lot of people trust fake site Scammer prepares to inject a virus, Fake electrum looks clean from virus atm.
When looking at fake exodus site I found a lot of phishing
https://www.virustotal.com/gui/url/8bb6a4ef386b9c29d2cc00509aa3a44ec7d7dbf792f057074ad0ec471d8611e9/detection

This thing could really fool lots of people. The site looks so fine and legitimate that you won't think any bad about it, not even a doubt. People should really take caution and be extra careful of what websites they are going to website. Since there are websites who are copying the graphic user interface of original websites, they coukd put a bookmark to their most visited  sites so that they won't be redirected and use fake ones which might be packaged with other malicious softwares.

[Bightening]

OHMYDAYS thanks for the warning! I have just had a call from this number that offered to sell me bitcoin and told me to go to this webpage!! I told him I had to check it over first and give him a call back and stumbled across this  https://scam-numbers.co.uk/Number/0031858888229/ and also this post so thanks guys! Seems to be a scam for sure! If anyone can point me in the direction of a legitimate seller that would be grand! Thanks, Sabrina x

There’re a good number of exchanges that would sell you bitcoins. I don’t know your country/region, or your payment option, so can’t help.

Phishing tricks keep getting better. Every internet user should keep that information in mind every time you use the internet, most especially when it comes to finances and privacy.
I’m working on a thread that explains more details on phishing tricks forum users like btt are liable to, and should be aware of.

[Casdinyard]

OHMYDAYS thanks for the warning! I have just had a call from this number that offered to sell me bitcoin and told me to go to this webpage!! I told him I had to check it over first and give him a call back and stumbled across this  https://scam-numbers.co.uk/Number/0031858888229/ and also this post so thanks guys! Seems to be a scam for sure! If anyone can point me in the direction of a legitimate seller that would be grand! Thanks, Sabrina x

If you prefer to buy on your local, head on here.
https://localbitcoins.com/

But you can buy more conveniently on exchange sites sich as binance and bittrex and other reputed sites.
You can create your account here.
https://www.binance.com/m-register.html
https://global.bittrex.com/account/register

Good thing you didn't easily believe on those cold callers. Next time be careful where you sign up such as giving your personal information since cold callers use this to keep bothering you.