How a crypto related website fall for a phishing thru Google Ad and gets hack

[Jating]

I will just share you an interesting story about a crypto related website, who admit that they have fallen for a phishing attack and lost almost 0,615 BTC. They blame Google, although I must admit that Google has a lot of security lapses and we have been calling them for years to no avail. So it really fall on our lap not to used their services or at least minimised our exposure and do due diligence when using their services.

How it all started

On  September 23, we needed to log in to the editorial BTC wallet to pay for the services.  Phishing is most dangerous for “hot wallet” users — we kept our funds at Blocкchain.com — and fraudsters stole almost 0,615 BTC from it. You can track the phishers’ address here

At the time of publication, it turned out that 4.6 BTC from 16 transactions had already accumulated on the phishers' address — at least 12 more people fell for the bait. Imagine if there are more addresses though...

Mistake #1

Our wallet account operator used Google search console, entering a “blockchain” query. The official website is 1st among the organic results, but… fraudsters use Google AdWords to place their ad which leads to the phishing website. Noone is protected from social engineering: users can be hasty or distracted and follow the phishing link. This way, our operator was directed to the false authorization page which looks exactly like the official page.

https://cryptonews.net/en/news/security/385689/

Again, Google has been notorious for allowing crypto phishing to show in their ads. We have seen hundreds of reports, from blockchain.com, to exodus, to atomic wallet to Poloniex and Binance to Bitmain to Uni and Defi thingy, everything under the sun.

In a perfect world, this shouldn't happen, but that is not the case, even crypto-related websites such as this one can be a victim here.

[1715033539]

1715033539

[1715033539]

1715033539

[1715033539]

1715033539

[1715033539]

1715033539

[1715033539]

1715033539

[GreatArkansas]

We can blame Google somehow here but the real problem here is the user itself. A lack of knowledge on these kinds of hack, newbies or non-techy people is really vulnerable to this attack.
I also experienced this phishing thru Google ad before, a lot of them are showing on the first-page result after you search in Google, but there is a label there if the result is an Ad.
I don't want that Google may ban soon cryptocurrency-related projects on their platform, it will cause a FUD for sure.

[o_e_l_e_o]

Stop using Google to find the website of exchanges, services, or wallets.

Stop following random links without checking the URL.

Start using uBlock Origin.

Never type your seed in anywhere.

How many times does this need repeated?

[Pmalek]

I don't like seeing people lose money, but I cant understand how a site who deals with crypto-related news doesn't know any better.
How do they not notice that the site they are entering says blochechain.com (DONT OPEN IT, IT'S FAKE!)

On top of that, it's an advertisement, which can be for anything. And you are not supposed to click on those when searching for a site via Google.

[blckhawk]

Stop using Google to find the website of exchanges, services, or wallets.

Stop following random links without checking the URL.

Start using uBlock Origin.

Never type your seed in anywhere.

How many times does this need repeated?

I used Google to search what website I am looking for because I had no idea where else to search for them. Fortunately, I haven't encountered any fraudulent webisite yet.
I think we cannot blame Google, well yes, they are partly responsible for it but it is still on us. Knowing that internet has full of duplicity, we should become more wary and should think before clicking any link online.
It is vague, but someone told me or perhaps I heard from anyone that website owner pays Google in order for their site to be shown upon the top search. It's all business we can't do anything regard with it that is why I said they are not to blame here.

[o_e_l_e_o]

It is vague, but someone told me or perhaps I heard from anyone that website owner pays Google in order for their site to be shown upon the top search. It's all business we can't do anything regard with it that is why I said they are not to blame here.

Google will happily accept money from scammers and fraudsters not only to run their ads, but to boost their ads to the top of search results. Google do no research in to the ads they accept - as long as someone is willing to pay them for the ad, then they are more than happy to run any and every scam ad around and do not care if users such as OP or yourself lose money. As long as they make a profit, that's all that matters.

Google are an immoral bunch of privacy invading thieves, as far as I am concerned. Notice that every post we see on here complaining about scams in search results is about Google. I've never seen a single post complaining about scam results showing up in good privacy respecting search engines such as DuckDuckGo or Qwant.

Stop using Google. You are freely handing over your data for the privilege of being scammed.

[ReiMomo]

I guess google company didn't care about the possible phishing ads, for them, business is just a business but once you reported the phishing link to them, good thing they will automatically delete the link. There are many newbies that still fall on this because of their laziness.

Everyone should aware of this, don't trust google ads and it should verify the link before clicking it or use it. You can directly type the URL link on the google tab or much better bookmark the link that you already visited to avoid this kind of scam.

[Charles-Tim]

Stop using Google. You are freely handing over your data for the privilege of being scammed.

Google are privacy invader, so far they have central authority, their should be ways they can stop displaying malicious ads, but so far the malicious actors and companies do pay them great amount of money to display their ads, it will be difficult for google to look into this, it is what they can do but they will not do it. That is why there are many legit scams. We are now in the world of open scams, where you will see organizations scamming people but governments will not do anything about it. In fact, I still do complain that centralized bodies have failed the world. I later have to know that how centralized they say the internet is, legit companies which are actually not legit are incredibly advertising scam websites.

Although, I do not use my wallet devices to play at all, I do not even use it for any searches, I only use it for three purposes which are wallets, exchange accounts and banking accounts. Aside that, I do not use it for another reasons. I was so afraid not to use it for another activities because centralized bodies generally spreading scams, including the YouTube, facebook, telegram, twitter and many other social media.

I like the fact that decentralizetion is opening our eyes to what centralization has done us, it only make people weak and lack how to protect themselves. If not for bitcoin, there will not be this forum, and did you know how this forum has enlighten us to know how dangerous internet can be, but what are the centralized aspects of the world doing than leaking privacy, making the world unfit for us to live without privacy.

Google are privacy invaders, they are directing people towards the way of scamemers. And many people will not know about all these obvious scams as new people will still be scammed daily.

[bitsurfer2014]

Too bad, a simple url inspection could have prevented that incident and it was very obvious a .sc country code domain seems suspicious  or better yet, if they have just bookmarked blockchain.com then they wouldn't fell victim to such fraud.

Yet in the lighter side, I think that crypto related website was somehow fortunate that only less than 1 BTC of their fund were stolen, where I think it coud be worst if that wallet have a huge amount stored in it.

[DdmrDdmr]

Weird that the resulting site you view is different depending if you get there through the Ad, or type the url in a browser. If I type the URL reflected in the OP’s screenshot, I’m taken to a site about Africa, whilst the article in the OP leads to a cookislands travel website. Not that this is the method that is being used (direct url entry), but if anyone cares to comment as to the how and why of this behaviour, I’d be interested in knowing.

Scammers are up to 10 BTC so far.

<...>

What I still don't see is "why" they do this (different site viewed from Google than from direct access).

[Mahdirakib]

~snip~

It's really worried! While I typing the URL directly in address bar it taking me at a site which is about Africa as you mentioned. We are visiting the original website by typing the URL directly.

Main fact is that the website might got hacked. And it's a set-up by hacker. While people trying to visit the website through Google search, it redirecting them to hacker website which is showing in OP screenshot.

Someone compliant about same thing at Google support community about his website. I'm quoting the answer here of the issue.

Your site is hacked.
When you browse the site just by browsing to it, then it works OK.
But when the user comes via Google, then it shows the pharmacy content / redirect
That is called a conditional hack.
So someone hacked your site so it shows different content when you visit the site via Google

Source:: Google redirect / forward my website to wrong URL

Though I don't have any idea that how hacker make those changes. But I think we can't blame Google for this kind of issue.

[pixie85]

Though I don't have any idea that how hacker make those changes. But I think we can't blame Google for this kind of issue.

Really? A multimillion dollar company hiring the best security specialists and coders in the world cannot be blamed for glitches?

They have all the means to rectify this but they don't care. Google and Youtube prefer to spy on you and go against the freedom of speech but are too busy to fix real issues.

[Assface16678]

They are paying google ads so if someone searches a related on this kind of topic the Google immediately suggested this website and we cannot blame them because it's paid all of the things right now is on part of the user. If you are an aware user who knows what is the real spelling of the "blockchain".

We do not tolerate being newbie on searching, but still, there are some newbies are falling on this website. Please make a background check before entering a website.

[bitsurfer2014]

Weird that the resulting site you view is different depending if you get there through the Ad, or type the url in a browser. If I type the URL reflected in the OP’s screenshot, I’m taken to a site about Africa, whilst the article in the OP leads to a cookislands travel website. Not that this is the method that is being used (direct url entry), but if anyone cares to comment as to the how and why of this behaviour, I’d be interested in knowing.

Scammers are up to 10 BTC so far.

<...>

What I still don't see is "why" they do this (different site viewed from Google than from direct access).

As per info from OP article, maybe this could be the real reason why the link shows two different sites.

What is noteworthy is that if you try to type in this address without clicking on the advertisements, you will be redirected to the page backclain.com which is a copy of cookislands.travel website. Apparently, such manipulation is needed to bypass Google's validation when registering malicious advertising.

A diversionary tactic to fool Google's mechanisms.

[btc_angela]

It's business, maybe those criminals found a way to circumvent Google ads that's why they got pass Google, but as a service provider they should have check everything first before allowing anyone applying to have their ads on top of their search engine. And for us we should be careful and I agree that we should bookmark everything so that we fall for this. And then have a good security hygiene, so education is the key.

[Twinkledoe]

I don't like seeing people lose money, but I cant understand how a site who deals with crypto-related news doesn't know any better.
How do they not notice that the site they are entering says blochechain.com (DONT OPEN IT, IT'S FAKE!)

On top of that, it's an advertisement, which can be for anything. And you are not supposed to click on those when searching for a site via Google.

It is very obvious and yet they fell for it. So what it is saying about them, they are also after for the potential profit. A lot of google ads are just click baits. And most of them are not yet reported to google so we really should be careful in touching those unfamiliar sites.

[Rengga Jati]

First, google will be plaFirst of all, Google is certainly pleased to accept anyone paying for Ads. And I don't know whether Google has security or a system that can detect that they are scammers or not. And I don't think so because so far there have been several cases of phishing or scammers in Google Ads.
Therefore, Google provides a way of reporting that these ads are a scam. So that if we find sites like that we have to report them immediately. yes even though Google needs to review and also get lots of evidence and reports related to this. but the sooner the better to report it.

However, if these ads still exist, then like this, there will be many more people who are deceived and exposed to scams.
Why?
- They are too hasty to believe these ads
- they don't know that scammers are everywhere
- they didn't do any further analysis.
- These ads are too convincing for some people

But of course, we can't also blame the victims fully because they may not know yet about this.

--snip--

this will exactly help. Moreover, commonly the sites are really closed similar with the real one. So, wothout any careful analysis, we will be trapped.