[List] Phishing Cryptocurrency Site

[Chikito]

Be careful of this :

fake MyEtherWallet: https[:]//myetherwallet-extra-bonuses.000webhostapp.com/access-my-wallet/

reported.

Code:

Domain Name: 000WEBHOSTAPP.COM
       Registry Domain ID: 2027404438_DOMAIN_COM-VRSN
       Registrar WHOIS Server: whois.hostinger.com
       Registrar URL: http://www.hostinger.com
       Updated Date: 2017-04-05T08:04:14Z
       Creation Date: 2016-05-11T13:34:12Z
       Registry Expiry Date: 2022-05-11T13:34:12Z
       Registrar: Hostinger, UAB
       Registrar IANA ID: 1636
       Registrar Abuse Contact Email: abuse@hostinger.com
       Registrar Abuse Contact Phone: +37064503378
       Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
       Name Server: DNS1.000WEBHOST.COM
       Name Server: DNS2.000WEBHOST.COM
       DNSSEC: unsigned
       URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
    >>> Last update of whois database: 2019-10-30T12:23:33Z <<<

[Wysi]

Be careful of this :

fake MyEtherWallet: https[:]//myetherwallet-extra-bonuses.000webhostapp.com/access-my-wallet/

reported.

Code:

Domain Name: 000WEBHOSTAPP.COM
       Registry Domain ID: 2027404438_DOMAIN_COM-VRSN
       Registrar WHOIS Server: whois.hostinger.com
       Registrar URL: http://www.hostinger.com
       Updated Date: 2017-04-05T08:04:14Z
       Creation Date: 2016-05-11T13:34:12Z
       Registry Expiry Date: 2022-05-11T13:34:12Z
       Registrar: Hostinger, UAB
       Registrar IANA ID: 1636
       Registrar Abuse Contact Email: abuse@hostinger.com
       Registrar Abuse Contact Phone: +37064503378
       Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
       Name Server: DNS1.000WEBHOST.COM
       Name Server: DNS2.000WEBHOST.COM
       DNSSEC: unsigned
       URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
    >>> Last update of whois database: 2019-10-30T12:23:33Z <<<

These hackers an go to any extend in order to cheat people. Thank you so much for bringing this to our notice as this will help most of the newbies and those users who are rarely uses MEW. MEW is doing it's part by asking us to double check the URL link before we enter any details. We need to be more cautious as these hackers might come up with same tactics for other exchanges as well.

[Chikito]

Found another LocalBitcoins Phising site

Fake: localbcoin.com



Scanned by Virustotal
https://www.virustotal.com/gui/url/98ec2e650058b3d527d441a7d8d614ea77d32335b83aebeac78f98c0cbe7c007/detection

Code:

Domain Name: LOCALBCOIN.COM
Registry Domain ID: 2448745451_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: http://www.namecheap.com
Updated Date: 2019-10-28T04:15:26Z
Creation Date: 2019-10-28T04:05:28Z
Registry Expiry Date: 2020-10-28T04:05:28Z
Registrar: NameCheap, Inc.
Registrar IANA ID: 1068
Registrar Abuse Contact Email: abuse@namecheap.com
Registrar Abuse Contact Phone: +1.6613102107
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Name Server: DNS1.NAMECHEAPHOSTING.COM
Name Server: DNS2.NAMECHEAPHOSTING.COM

Be Aware newbie should double-check before sign in

[Lucius]

I check all links posted by OP, and only last for fake LB is blocked by Chrome as a dangerous site, all other sites are still fully accessible and pose a threat to uninformed users. More reports will help to change the situation and to do that just report all links to: https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

[Chikito]

I check all links posted by OP, and only last for fake LB is blocked by Chrome as a dangerous site, all other sites are still fully accessible and pose a threat to uninformed users. More reports will help to change the situation and to do that just report all links to: https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en

I did the report. Maybe google support team have a weekend.

And today found fake binance dex: btnance.org



https://www.virustotal.com/gui/url/2d98a050dc1ce3d617da8d4a59f253147f51b3d7dd837e06506b7f449da732b4/detection

[masulum]

@OP to avoid any accident unwanted clicking any suspicious website, maybe you can edit link and make it un-clickable, or better to use code tag. Sometimes when visiting this forum using mobile phone, it's very possible to make unwanted clicking content.

Thank you, and good job to make any phishing website related to crypto in one place.

[Casdinyard]

@OP to avoid any accident unwanted clicking any suspicious website, maybe you can edit link and make it un-clickable, or better to use code tag.

Or don't put the link anymore and besides there's already an image of the fake site. Just to be more safe, I mean some are not really mindful.

Btw, already reported the sites. Thanks for the heads up. Keep it up.

[panganib999]

Phishing exodus wallet site: https://exodlus.io
original here: https://exodus.io/

Look screenshot here ;

Woah. It seems legit that it won't give you any doubts and red flags about joining and using it.  These criminals are really getting smarter and smarter as they try to develop and make more phishing and scamming sites. This is why  beginners, it is essential if you take vigilance seriously and take it with you all through out your journey here in crypto space. This thread would be very helpful to raise awareness for beginners. Also always avoid impulsively clicking links from unknown sources you could avoid click baits.

[Chikito]

Phishing exodus wallet site:

Code:

//exodlus.io

Found another fake exodus :

Code:

//exodlus.com

https://www.virustotal.com/gui/url/0b7e767c5b2ee3a3a69e4c84711609fef7d842fc2da926a3e63e4081f9ff02d3/detection

Scanned and nothing virus on site

What the different?

Let's check domain information

Fake - Domain EXODLUS.COM info

Code:

Domain name: EXODLUS.COM
Registry Domain ID: 2450282733_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.reg.com
Registrar URL: https://www.reg.com
Registrar URL: https://www.reg.ru
Updated Date: 2019-11-01T01:06:17Z
Creation Date: 2019-11-01T01:06:16Z
Registrar Registration Expiration Date: 2020-11-01T01:06:16Z
Registrar: Registrar of domain names REG.RU LLC
Registrar IANA ID: 1606
Registrar Abuse Contact Email: abuse@reg.ru
Registrar Abuse Contact Phone: +7.4955801111
Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Registrant ID:
Registrant Name: Protection of Private Person
Registrant Street: PO box 87, REG.RU Protection Service
Registrant City: Moscow
Registrant State/Province:
Registrant Postal Code: 123007
Registrant Country: RU
Registrant Phone: +7.4955801111
Registrant Phone Ext:
Registrant Fax: +7.4955801111
Registrant Fax Ext:
Registrant Email: EXODLUS.COM@regprivate.ru
Admin ID:
Admin Name: Protection of Private Person
Admin Street: PO box 87, REG.RU Protection Service
Admin City: Moscow
Admin State/Province:
Admin Postal Code: 123007
Admin Country: RU
Admin Phone: +7.4955801111
Admin Phone Ext:
Admin Fax: +7.4955801111
Admin Fax Ext:
Admin Email: EXODLUS.COM@regprivate.ru
Tech ID:
Tech Name: Protection of Private Person
Tech Street: PO box 87, REG.RU Protection Service
Tech City: Moscow
Tech State/Province:
Tech Postal Code: 123007
Tech Country: RU
Tech Phone: +7.4955801111
Tech Phone Ext:
Tech Fax: +7.4955801111
Tech Fax Ext:
Tech Email: EXODLUS.COM@regprivate.ru
Name Server: ns1.reg.ru
Name Server: ns2.reg.ru
DNSSEC: Unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2019.11.03T15:05:23Z <<<

Fake - Domain EXODLUS.IO info

Code:

Domain Name: EXODLUS.IO
Registry Domain ID: D503300001182128865-LRMS
Registrar WHOIS Server:
Registrar URL: http://www.epag.de
Updated Date:
Creation Date: 2019-10-29T20:14:17Z
Registry Expiry Date: 2020-10-29T20:14:17Z
Registrar Registration Expiration Date:
Registrar: EPAG Domainservices GmbH
Registrar IANA ID: 85
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone:
Reseller:
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Domain Status: addPeriod https://icann.org/epp#addPeriod
Registrant Organization:
Registrant State/Province:
Registrant Country: CA
Name Server: NS1.REG.RU
Name Server: NS2.REG.RU
DNSSEC: unsigned

Real Exodus.io Info

Code:

Domain Name: EXODUS.IO
Registry Domain ID: D503300000040368494-LRMS
Registrar WHOIS Server:
Registrar URL:
Updated Date: 2019-09-30T21:21:05Z
Creation Date: 2015-04-06T04:48:53Z
Registry Expiry Date: 2024-04-06T04:48:53Z
Registrar Registration Expiration Date:
Registrar: CloudFlare, Inc.
Registrar IANA ID: 1910
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone:
Reseller:
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Registrant Organization: WhoisGuard, Inc.
Registrant State/Province: Panama
Registrant Country: PA
Name Server: JESSICA.NS.CLOUDFLARE.COM
Name Server: FRANK.NS.CLOUDFLARE.COM
DNSSEC: unsigned

The newbie must be careful about giveaway like this site:

Code:

//freebtceth.com
//btcandeth.com
//bakkt-gift.info

Those aren't given away BTC and ETH, you will get the virus and scammed.

https://www.virustotal.com/gui/url/ad081ab0ad668b09021d22fbc91ce363c57b924bb1f25ea9ceacd59c83762030/detection
https://www.virustotal.com/gui/url/eb5e8d1cd0d0e6b364a80f08a9cae10b4bfe012de46425b7e740bff2cc75fb9d/detection
https://www.virustotal.com/gui/url/eed4f52ce1ad8da6f40e6f2cd34f49bc0e3728403112c38645da87682dbe2ae2/detection

[Chikito]

>>> Help me to report IP address: 185.212.130.65 because always make the phishing site

https://www.virustotal.com/gui/ip-address/185.212.130.65/relations

Code:

2019-11-06-exodlus.io
2019-11-06-iocabitcoins.net
2019-11-06-iliocalbitcoins.net
2019-11-05-locabicoins.net
2019-11-05-localbiicoins.net
2019-11-05-litecoln.org
2019-11-05-localibitcoins.ru.com
2019-11-05-localbitcolins.net
2019-11-04-atomicwalet.com
2019-11-04-www.exodlus.com
2019-11-04-exodlus.com
2019-11-04-llocalbitcoins.net
2019-11-04-liocalbitcoins.net
2019-11-04-localbitcoinis.net
2019-11-04-loca1bitcoins.net
2019-11-04-ilocalbitcoins.net
2019-11-04-locaibitcolns.com
2019-11-04-iocalbitcoins.net
2019-11-04-loca1bitcoins.com
2019-11-04-iocalblitcoins.net
2019-11-04-iocalbicoins.net
2019-11-04-www.monnero.org
2019-11-04-www.electum.org
2019-10-27-localbitcolns.org
2019-10-27-localbitcoln.ru
2019-10-27-nicelhash.com

Scammer every day makes phishing like atomicwalet.com, locaibitcolns.com, litecoln.org, exodlus.io, etc.

I did report and need more people here to report those IP.

Thanks.
 

[~Money~]

>>> Help me to report IP address: 185.212.130.65 because always make the phishing site

https://www.virustotal.com/gui/ip-address/185.212.130.65/relations

....

Scammer every day makes phishing like atomicwalet.com, locaibitcolns.com, litecoln.org, exodlus.io, etc.

I did report and need more people here to report those IP.

Thanks.
 

Netherlands DCs won't care much about content on their servers, they are famous in this field since the beginning,
I had build a case against someone using their servers to make DDoS attacks in very big scales but they didn't even replied emails and court simply closed the case 

reporting those IPs might help other services take action in sending warning messages to their users, but if you are trying to report them to bring those IPs or servers down, you won't face any success easily

[Chikito]

Found this
Original site : https://bittab.io/
Fake  webite : //bittab.org/

Code:

Domain Name: BITTAB.IO
Registry Domain ID: D503300000064550605-LRMS
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: www.namecheap.com
Updated Date: 2019-01-11T12:36:34Z
Creation Date: 2018-02-10T16:02:51Z
Registry Expiry Date: 2020-02-10T16:02:51Z
Registrar Registration Expiration Date:
Registrar: NameCheap, Inc
Registrar IANA ID: 1068

Code:

Domain Name: BITTAB.ORG
Registry Domain ID: D402200000011818438-LROR
Registrar WHOIS Server: whois.reg.com
Registrar URL: http://www.reg.com
Updated Date: 2019-11-05T15:07:04Z
Creation Date: 2019-11-05T15:07:01Z
Registry Expiry Date: 2020-11-05T15:07:01Z
Registrar Registration Expiration Date:
Registrar: Registrar of Domain Names REG.RU LLC
Registrar IANA ID: 1606

Be careful No different with original website

[Chikito]

Real Website: https://exmo.com/

Phishing website

Code:

https://exmo.me/

Real Website: https://exmo.com/

Code:

Domain Name: EXMO.COM
Registry Domain ID: 92842160_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.internet.bs
Registrar URL: http://www.internet.bs
Updated Date: 2017-11-14T10:53:38Z
Creation Date: 2002-12-05T06:16:28Z
Registry Expiry Date: 2021-12-05T06:16:28Z
Registrar: Internet Domain Service BS Corp
Registrar IANA ID: 2487

Phishing website

Code:

Domain Name: EXMO.ME
Registry Domain ID: D108500000015705565-AGRS
Registrar WHOIS Server:
Registrar URL: www.tldregistrarsolutions.com
Updated Date: 2017-09-18T14:32:13Z
Creation Date: 2015-04-05T10:07:04Z
Registry Expiry Date: 2020-04-05T10:07:04Z
Registrar Registration Expiration Date:
Registrar: TLD Registrar Solutions Ltd.
Registrar IANA ID: 1564

https://www.virustotal.com/gui/url/a7c9f98d3cf4a248bdaf05a6d0461f5ef85bdd2d33d89a47f134c602a13d105b/detection



Be Careful Noobs

[Chikito]

Let's see how Scammer manipulated MyEtherWallet

Code:

http://muetherewallet.com/
http://myeiherwollet.com/
http://myentervallet.com/
http://myelhereswallet.com/
http://myeitnerwaliet.com/
http://myethereswallets.com/
http://myehtervallet.com/
http://myelherewallets.com/
http://rnyethereswallet.com/
http://myelherewallut.com/

https://www.virustotal.com/gui/url/37c0a2a5637bb8281cc9380521a05a71e8df0fc8145369a90abd4fb76a1605af/detection
https://www.virustotal.com/gui/url/a33df647cffe55ad19f68768b5b7b405dc1b1dd0c49304e2d341ff364970e3e2/detection
https://www.virustotal.com/gui/url/af3748494186d8324bbb2e27efddc7d6f88f31b3bc5a464f8592b2e594721745/detection
https://www.virustotal.com/gui/url/3f29d61018c75517c59473a1d2542b699ee68a19f612c28a965032b5566eba03/detection
https://www.virustotal.com/gui/url/3fe9099a684ef833a09fc72dfe23ba2ce7ae7770f58c97301a373816497418b9/detection
https://www.virustotal.com/gui/url/637b8188d639b613d3c553413e7f62ed8cec8e689d4cfefcd7527007292eb93b/detection
https://www.virustotal.com/gui/url/3fd3fc809e360bec502f6fbfe08d6a1e837357cffd2d5f0706a167df966c8d53/detection
https://www.virustotal.com/gui/url/64bef2b379158dd717f86ce9f2bff6ba473c16dada47819290a076b9931407d2/detection
https://www.virustotal.com/gui/url/dd1b7ce1a738d1b96859bdcf6c5dd692db5387c0c43ccabcf705050307e009d7/detection
https://www.virustotal.com/gui/url/191abfdf5f38b48af58b30f0d7547d7205f8c896b0881d661fdf90a4ce919518/detection

One of them still make the offering



Newbie and beginner must far away from those sites, they will be stolen your money

[Chikito]

This IP 149.129.176.152 have Multi Phising site cryptocurrency : Trezor, ledger, etc

https://www.virustotal.com/gui/ip-address/149.129.176.152/relations

Code:

www.treezor.io
www.trezor.promo
leedger.info
www.tlezor.io
www.trrezor.io
www.exodus.ws
www.exodus.bet

Example :

Code:

treezor.io

https://www.virustotal.com/gui/url/8739ebbfb4442de492fa5b0328f179a81dde142609eef9e8ecd1028f4b3116d0/detection

BitDefender
Phishing
ESET
Phishing
Fortinet
Phishing
G-Data
Phishing
Sophos AV
Malicious

I thing the scammer Will continue to make phishing site using that IP, be carefull nobsss..

[Chikito]

Phishing Blockchain.com

Code:

https://login-blockchajn.com

Domain Information:

Code:

IP Address: 103.16.228.163
Geolocation: HK (Hong Kong)
Domain Name: LOGIN-BLOCKCHAJN.COM
Registry Domain ID: 2443618596_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.registrar.eu
Registrar URL: http://www.openprovider.com
Updated Date: 2019-10-14T18:32:52Z
Creation Date: 2019-10-14T18:32:46Z
Registry Expiry Date: 2020-10-14T18:32:46Z
Registrar: Hosting Concepts B.V. d/b/a Openprovider
Registrar IANA ID: 1647

https://www.virustotal.com/gui/url/06326ba8493ba4efae4856518c627a5128642773dde28b14ede3b3f78603a17c/detection

BitDefender-Phishing
CLEAN MX-Phishing

Be Careful

[Chikito]

Fake Give away Bitcoin and Ethereum

Code:

http://elonmuskgo.com/

Be aware scammer use fake medium Elon musk to give away Bitcoin and ethereum



The link will direct you to send BTC and ETH to get 10X, this is fake and potential scam.





https://www.virustotal.com/gui/url/4539c3892433c86efa77b48f6ad88f48c696ee970983aa14ad6439328d7a09ba/detection

Code:

IP Address: 195.24.68.21
Domain Name: ELONMUSKGO.COM
Registry Domain ID: 2467017887_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.nic.ru
Registrar URL: http://nic.ru
Updated Date: 2019-12-14T11:35:06Z
Creation Date: 2019-12-14T11:35:04Z
Registry Expiry Date: 2020-12-14T11:35:04Z
Registrar: Regional Network Information Center, JSC dba RU-CENTER

Let's see related IP
https://www.virustotal.com/gui/ip-address/195.24.68.21/relations



Be careful Elon musk never give away cryptocurrency

[Chikito]

Warning BTC and eth give away, sending your fund first for receipt 100x BTC and eth.

Code:

http://btcandeth.com/
http://btcethgift.com/

Domain information

Code:

IP Address: 185.174.174.220
Geolocation: UA (Ukraine)
Domain Name: BTCETHGIFT.COM
Registry Domain ID: 2429780829_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namesilo.com
Registrar URL: http://www.namesilo.com
Updated Date: 2019-09-04T00:45:50Z
Creation Date: 2019-09-04T00:45:50Z
Registry Expiry Date: 2020-09-04T00:45:50Z

It's really fake, don't send your Bitcoin. They will be scamming you.

[TravelMug]

I found this fake ETH giveaway:

Code:

https://eth-giveout.com/

Scammers ETH:

Code:

0xB5c06ce49d0C63211E5d335Cf42ecdA5C3f30D8a

Code:

IP Address: 	162.241.217.210 - 1,641 other sites hosted on this server
IP Location: 	United States - Utah - Provo - Unified Layer
ASN:   	        United States AS46606 UNIFIEDLAYER-AS-1 - Unified Layer, US (registered Oct 24, 2008)
Domain Status: 	Registered And Active Website
IP History: 	2 changes on 2 unique IP addresses over 0 years 

https://www.virustotal.com/gui/ip-address/162.241.217.210/relations

[Jiyens3]

Beginners and newbie on the cryptocurrency world should be careful about the phishing website. A lot of Scammers out there used a fake website to steal your Bitcoin.

Read 5 Ways to Identify a Phishing Website and Read [GUIDE] Use this for identifying Scam/Phishing Websites & Exchanges in Crypto

On this thread, I want to share what I found out there.

1. Phishing exodus website: //exodlus.io
original: https://exodus.io/

Look screenshot here ;

Code:

Network
185.212.130.0/24 (AS200313 INTERNET-IT, NL)
Whois
Domain Name: EXODLUS.IO
Registry Domain ID: D503300001182128865-LRMS
Registrar WHOIS Server:
Registrar URL: http://www.epag.de
Updated Date:
Creation Date: 2019-10-29T20:14:17Z
Registry Expiry Date: 2020-10-29T20:14:17Z

When scanning virus total has warned:
https://www.virustotal.com/gui/url/8bb6a4ef386b9c29d2cc00509aa3a44ec7d7dbf792f057074ad0ec471d8611e9/detection
BitDefender-Phishing

Flagged Ip address 185.212.130.65

Related IP

Look This fake  site using same IP address :

electum.org
litecoln.org
bitcolncore.org
guimlner.org
minergate.ru.com
nvldia.ru
monnero.org

2. Fake electrum site : electum.org



3. Fake litecoin site : litecoln.org



4. Fake Bitcoincore site: bitcolncore.org


5. Phising Localbitcoins

6. Phishing Blockchain.info

I will update this thread when I found another phishing.

so usefull thread, phising web very harmful. such you said above many phising website and on of them is myetherwallet
honestly, i have experienced phising in myetherwallet. i am forgot how i can go to for phising web then suddenly i lose all my token in myetherwallet
so sad about that. so from that case i always to bookmark all important address