[Scam]: Another Fake Coinbase Giveaway

[Baofeng]

What happened: Fake Coinbase 50 million users giveaway

Website:

Code:

https://btcmust.com/

Archived: http://web.archive.org/save/https://btcmust.com/



http://whois.domaintools.com/btcmust.com

Dates    2 days old
Created on 2019-12-12
Expires on 2020-12-12
Updated on 2019-12-13    
 
Name Servers    NS1.QHOSTER.NET (has 6,785 domains)
NS2.QHOSTER.NET (has 6,785 domains)
NS3.QHOSTER.NET (has 6,785 domains)
NS4.QHOSTER.NET (has 6,785 domains)
   
 
Tech Contact    Domain Administrator
See PrivacyGuardian.org
1928 E. Highland Ave. Ste F104 PMB# 255,
Phoenix, AZ, 85016, us

(p)
IP Address    185.38.151.11 - 257 other sites hosted on this server
   
 
IP Location    United Kingdom - England - Bristol - Hydra Communications Ltd

[1714966064]

1714966064

[1714966064]

1714966064

[1714966064]

1714966064

[Theb]

Just for future references how/where do you manage to find these kinds of fake giveaways online or from what source did you discover this website? Because when I do my regular way of browsing the internet that includes a lot of time in the social media, Google, and Youtube I barely see these types of fake giveaways except from the Scam accusation board. It just makes me wonder how these types of fake giveaways manage to scam a lot of people. One thing to note that is this website on their "live transaction" page is posting fake transactions just to make it look like they are receiving and sending payments on their end.

[Chikito]

with that IP we can detect all related site and scammer always make another fake or scam
for example:

Code:

https://btcmust.com/

when searching relation IP we can find another fake:

https://www.virustotal.com/gui/ip-address/185.38.151.11/relations

Code:

https://btc-top.com/

Code:

IP Address: 185.38.151.11
Domain Name: BTC-TOP.COM
Registry Domain ID: 2466980232_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namesilo.com
Registrar URL: http://www.namesilo.com
Updated Date: 2019-12-14T21:14:07Z
Creation Date: 2019-12-14T00:29:16Z
Registry Expiry Date: 2020-12-14T00:29:16Z
Registrar: NameSilo, LLC
Registrar IANA ID: 1479

Scammer always camouflages and changed another BTC address and domain, but forgot to change the IP address.

[Kemarit]

Good catch, so these criminals are just repeating their process, once they have been busted, they go to the next domain name that seems to be harmless and legit.

So we need to be vigilant and we have to thank people in this community finding and giving us a heads up and I do hope that newbies will check this thread first.

[Kyraishi]

I've actually seen a bunch of these clone websites personally. Reminds me a bit of the old CEX clones that used to pop up under different domain names each time as well.

The best thing that you can do is just to report each one as you see them to the domain host, and hopefully you'll get taken down. With the sheer amount of them in existence though removing all of them is simply impossible.

Use your common sense and think about why anyone, especially a multimillion company would be giving away 10x your deposit when their ROE is probably less than that in years. Prevention is better than cure, always.

[MURONDI]

with that IP we can detect all related site and scammer always make another fake or scam
for example:

Code:

https://btcmust.com/

when searching relation IP we can find another fake:

https://www.virustotal.com/gui/ip-address/185.38.151.11/relations

Code:

https://btc-top.com/

Code:

IP Address: 185.38.151.11
Domain Name: BTC-TOP.COM
Registry Domain ID: 2466980232_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.namesilo.com
Registrar URL: http://www.namesilo.com
Updated Date: 2019-12-14T21:14:07Z
Creation Date: 2019-12-14T00:29:16Z
Registry Expiry Date: 2020-12-14T00:29:16Z
Registrar: NameSilo, LLC
Registrar IANA ID: 1479

Scammer always camouflages and changed another BTC address and domain, but forgot to change the IP address.

thank you, it's very useful and can add to my insights regarding scam sites, although I don't really understand it, so you use the virustotal site to find out about scam sites, very helpful, I will learn about virustotal sites.

[Theb]

Scammer always camouflages and changed another BTC address and domain, but forgot to change the IP address.

Thank you for that info, so @Baofeng is that also your way on catching up different scam giveaway websites? You just monitor the known ip addresses they use and wait for a new website created under it? I was assuming early on that people just discover this on their regular day surfing the web that's why I'm still wondering why these types of websites are having so many victims in the first place. If this doesn't show up in Google I think the scammers are working manually on promoting the link in high traffic websites such as Facebook and Youtube.

[Baofeng]

Scammer always camouflages and changed another BTC address and domain, but forgot to change the IP address.

Thank you for that info, so @Baofeng is that also your way on catching up different scam giveaway websites? You just monitor the known ip addresses they use and wait for a new website created under it? I was assuming early on that people just discover this on their regular day surfing the web that's why I'm still wondering why these types of websites are having so many victims in the first place. If this doesn't show up in Google I think the scammers are working manually on promoting the link in high traffic websites such as Facebook and Youtube.

Yes, pretty much the same sort of "investigations". Facebook and Youtube are one of their primary targets, but they usually target forums as well. Been working as as SEO long time ago (white/ethical) that's why I frequented forums and found that that's where criminals are spreading this mostly.

[Reddiss]

I'm so sick of posts on twitter comments by these culprits. They are spamming everywhere and I just feel sorry for gullible newbies who would actually send funds there.

[TalkStar]

If my guess isn't wrong than these kinda money stealing giveaways are running by common and combine group of scammers. Last couple of weeks this guys were so active with fake facebook token related ICO and IEO investment traps and maybe still some of the are active now. Its a common scam trap where they take the advantage by using famous and well known crypto related platform. In recent time they are using the name of "Coinbase" to make new crypto users fool. I hope who have average experience about crypto investment will not fall for this kinda trap.

Coinbase authority should send email to all their registrants about this kinda fake activities which will definitely make their user much careful about any kinda bonus or giveaways.

Thanks OP for revealing this fake giveaway. Keep contributing to bring a scammer free environment on bitcointalk.  

[Baofeng]

Thanks OP for revealing this fake giveaway. Keep contributing to bring a scammer free environment on bitcointalk.  

Thank you @TalkStar for this kind words, it really means a lot to me. 

[stompix]

when searching relation IP we can find another fake:

There are actually far more than one

coinbasedo.com   2019-12-08
coinbaseup.com   2019-12-07
btcgift.pro 2019-12-07
binancetop.com   2019-12-16

All blocked by chrome security right now.
Anyhow that host is a cesspool, not only a bunch of virus-carrying websites but also domains like...DailyTeleGrPh.com , 

Good news, the address has only one tx, with only 70 cents in it.

[Reddiss]

when searching relation IP we can find another fake:

There are actually far more than one

coinbasedo.com   2019-12-08
coinbaseup.com   2019-12-07
btcgift.pro 2019-12-07
binancetop.com   2019-12-16

All blocked by chrome security right now.
Anyhow that host is a cesspool, not only a bunch of virus-carrying websites but also domains like...DailyTeleGrPh.com , 

Good news, the address has only one tx, with only 70 cents in it.

Lol 70 cents for all that effort. They should get a real job haha