Yaunfitda (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 08:34:01 AM |
|
(1) Take notice of the ẹ. Another type of homograph attack. Just created more than two weeks ago. chipmixẹr.com - https://xn--chipmixr-z30d.com/ ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FaptKgCN.png&t=665&c=rcy3e54bjkv5_w) Registrar NAMECHEAP INC NameCheap, Inc. IANA ID: 1068 URL: http://www.namecheap.comWhois Server: whois.namecheap.com (p) Registrar Status addPeriod, clientTransferProhibited Dates 18 days old Created on 2020-04-26 Expires on 2021-04-26 Updated on 0000-12-31 http://whois.domaintools.com/xn--chipmixr-z30d.com
(2) This one is a classic Typosquatting, or URL hijacking. Also this is created around two weeks ago. Notice the S. ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FFCQyiLW.png&t=665&c=xawk2jwmSFlkoA) Registrar Namesilo, LLC IANA ID: 1479 URL: http://www.namesilo.comWhois Server: whois.namesilo.com (p) Registrar Status clientTransferProhibited, serverTransferProhibited Dates 15 days old Created on 2020-04-29 Expires on 2021-04-29 Updated on 2020-04-29 http://whois.domaintools.com/chipmixers.io
|
|
|
|
R |
▀▀▀▀▀▀▀██████▄▄ ████████████████ ▀▀▀▀█████▀▀▀█████ ████████▌███▐████ ▄▄▄▄█████▄▄▄█████ ████████████████ ▄▄▄▄▄▄▄██████▀▀ | LLBIT | | | 4,000+ GAMES███████████████████ ██████████▀▄▀▀▀████ ████████▀▄▀██░░░███ ██████▀▄███▄▀█▄▄▄██ ███▀▀▀▀▀▀█▀▀▀▀▀▀███ ██░░░░░░░░█░░░░░░██ ██▄░░░░░░░█░░░░░▄██ ███▄░░░░▄█▄▄▄▄▄████ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ | █████████ ▀████████ ░░▀██████ ░░░░▀████ ░░░░░░███ ▄░░░░░███ ▀█▄▄▄████ ░░▀▀█████ ▀▀▀▀▀▀▀▀▀ | █████████ ░░░▀▀████ ██▄▄▀░███ █░░█▄░░██ ░████▀▀██ █░░█▀░░██ ██▀▀▄░███ ░░░▄▄████ ▀▀▀▀▀▀▀▀▀ |
| | | | | | .
| | | ▄▄████▄▄ ▀█▀▄▀▀▄▀█▀ ▄▄░░▄█░██░█▄░░▄▄ ▄▄█░▄▀█░▀█▄▄█▀░█▀▄░█▄▄ ▀▄█░███▄█▄▄█▄███░█▄▀ ▀▀█░░░▄▄▄▄░░░█▀▀ █░░██████░░█ █░░░░▀▀░░░░█ █▀▄▀▄▀▄▀▄▀▄█ ▄░█████▀▀█████░▄ ▄███████░██░███████▄ ▀▀██████▄▄██████▀▀ ▀▀████████▀▀ | . ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ░▀▄░▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄░▄▀ ███▀▄▀█████████████████▀▄▀ █████▀▄░▄▄▄▄▄███░▄▄▄▄▄▄▀ ███████▀▄▀██████░█▄▄▄▄▄▄▄▄ █████████▀▄▄░███▄▄▄▄▄▄░▄▀ ████████████░███████▀▄▀ ████████████░██▀▄▄▄▄▀ ████████████░▀▄▀ ████████████▄▀ ███████████▀ | ▄▄███████▄▄ ▄████▀▀▀▀▀▀▀████▄ ▄███▀▄▄███████▄▄▀███▄ ▄██▀▄█▀▀▀█████▀▀▀█▄▀██▄ ▄██▀▄███░░░▀████░███▄▀██▄ ███░████░░░░░▀██░████░███ ███░████░█▄░░░░▀░████░███ ███░████░███▄░░░░████░███ ▀██▄▀███░█████▄░░███▀▄██▀ ▀██▄▀█▄▄▄██████▄██▀▄██▀ ▀███▄▀▀███████▀▀▄███▀ ▀████▄▄▄▄▄▄▄████▀ ▀▀███████▀▀ | | OFFICIAL PARTNERSHIP SOUTHAMPTON FC FAZE CLAN SSC NAPOLI |
|
|
|
GreatArkansas
Legendary
Offline
Activity: 2422
Merit: 1370
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 09:01:09 AM |
|
ChipMixer should be aware of this. It's really amazing how scammers can easily copy the original website. I also saw some fake Bitcoin mixers website before especially around bull run 2017. Better if we also report these domains to their registrar or domain provider, abuse@namecheap.com and abuse@namesilo.com
|
█████████████████████████ ████████▀▀████▀▀█▀▀██████ █████▀████▄▄▄▄██████▀████ ███▀███▄████████▄████▀███ ██▀███████████████████▀██ █████████████████████████ █████████████████████████ █████████████████████████ ██▄███████████████▀▀▄▄███ ███▄███▀████████▀███▄████ █████▄████▀▀▀▀████▄██████ ████████▄▄████▄▄█████████ █████████████████████████ | BitList | | █▀▀▀▀ █ █ █ █ █ █ █ █ █ █ █ █▄▄▄▄ | ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ . REAL-TIME DATA TRACKING CURATED BY THE COMMUNITY . ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ | ▀▀▀▀█ █ █ █ █ █ █ █ █ █ █ █ ▄▄▄▄█ | | List #kycfree Websites |
|
|
|
Maus0728
Legendary
Offline
Activity: 1988
Merit: 1580
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 09:06:19 AM |
|
I wonder why there are always multiple phishing website that has similar fancy characters like this! "ẹ". Similarly, the other thread created by has also a similar fancy character in their URL in creating fake Ledger website. I think these are created by the same person or group of person! Anyways, link for reporting phishing link. https://safebrowsing.google.com/safebrowsing/report_phish/?hl=enphishing-report@us-cert.gov - email the link here!
|
|
|
|
DdmrDdmr
Legendary
Offline
Activity: 2422
Merit: 10978
There are lies, damned lies and statistics. MTwain
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 10:09:49 AM |
|
I wonder why there are always multiple phishing website that has similar fancy characters like this! "ẹ". <…>
Simply in order to make the URL name as close as possible to the original one they are trying to mimic. A little dot (as is the visual appearance) is a minor difference that may go unnoticed (who’s got a perfectly clean screen without any smudges on it?), and that is what the phishing site is counting on. Other classical spins are skipping or adding a letter, or permuting a couple of them. All these tricks are detectable if one is paying close attention, but not fast to spot when in a rush, or the site is not a regular site and one is landing there for the first time.
|
|
|
|
BITCOIN4X
Legendary
Offline
Activity: 2086
Merit: 1164
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 10:13:44 AM |
|
Registrar Status, clientTransfer Prohibited Dates 1,407 days old Created on 2016-07-07 Expires on 2025-07-07 Updated on 2019-12-11
This is the original chipmixer site and I just want to get the difference because I didnt get the information on the OP. Please add the original site and the details too for comparison, great for readers. ~snip
My guess is that they dont work alone and its like a group of people who are really crazy about other peoples possessions.
|
| | . .Duelbits│SPORTS. | | | ▄▄▄███████▄▄▄ ▄▄█████████████████▄▄ ▄███████████████████████▄ ███████████████████████████ █████████████████████████████ ███████████████████████████████ ███████████████████████████████ ███████████████████████████████ █████████████████████████████ ███████████████████████████ ▀████████████████████████ ▀▀███████████████████ ██████████████████████████████ | | | | ██ ██ ██ ██
██ ██ ██ ██
██ ██ ██ | | | | ███▄██▄███▄█▄▄▄▄██▄▄▄██ ███▄██▀▄█▄▀███▄██████▄█ █▀███▀██▀████▀████▀▀▀██ ██▀ ▀██████████████████ ███▄███████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ███████████████████████ ▀█████████████████████▀ ▀▀███████████████▀▀ ▀▀▀▀█▀▀▀▀ | | OFFICIAL EUROPEAN BETTING PARTNER OF ASTON VILLA FC | | | | ██ ██ ██ ██
██ ██ ██ ██
██ ██ ██ | | | | 10% CASHBACK 100% MULTICHARGER | │ | | │ |
|
|
|
BitcoinGirl.Club
Legendary
Offline
Activity: 2884
Merit: 2762
Bitcoingirl 2 is downloading 💓
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 11:39:27 AM Last edit: May 14, 2023, 05:10:39 PM by BitcoinGirl.Club |
|
![](https://ip.bitcointalk.org/?u=https%3A%2F%2Ftalkimg.com%2Fimages%2F2023%2F05%2F14%2Fblob5cde194a71e63263.png&t=665&c=aKW85-Y_1R26UA) This is very frustrating for me. All those days, I used to think that homograph attack can be caught using copy paste but with this ẹ, it seems there no difference with the original e. 🤔 Try yourself with Ctrl+F and then type e you will see both are highlighted below. e : English letter ẹ : homograph letter
|
|
|
|
btc_angela
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 11:52:30 AM |
|
Probably those are created by one group of cyber criminals. And it's really hard to detect at first glance, and we can see that this is a sophisticated attack using Chipmixer. There is a wonderful tool to check for Punny code here. https://www.punycoder.com/One way to able check on it is to click the padlock, -> certificate ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FkkZZOgA.png&t=665&c=AEDjFhkInPvbNQ)
|
|
|
|
boyptc
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 01:40:20 PM |
|
I think I've seen a similar letter with other known exchanges like Binance. That special character is being used by these abusers to fake websites that has letter e on its domain.
|
|
|
|
Velkro
Legendary
Offline
Activity: 2296
Merit: 1014
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 02:03:22 PM |
|
This is the original chipmixer site and I just want to get the difference because I didnt get the information on the OP. Please add the original site and the details too for comparison, great for readers. My guess is that they dont work alone and its like a group of people who are really crazy about other peoples possessions.
Agree here, adding original site for comparision is good thing to do. If someone posess such skills, copying over and over his fake website with different domain names isnt that hard. Phishing is one of main scam techniques in world wide web since forever ![Tongue](https://bitcointalk.org/Smileys/default/tongue.gif) . You can't eliminate them, there are so much of them, so best thing to do is educate the public about it.
|
|
|
|
Pffrt
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 02:11:52 PM |
|
I think I've seen a similar letter with other known exchanges like Binance. That special character is being used by these abusers to fake websites that has letter e on its domain.
Most of the phishing sites are based on homograph letter. You can change the i,a,e which looks same as the actual one and it makes easy to target even very smart trader with a lot of experience. It's an old school method of phishing.
|
|
|
|
boyptc
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 03:20:06 PM |
|
I think I've seen a similar letter with other known exchanges like Binance. That special character is being used by these abusers to fake websites that has letter e on its domain.
Most of the phishing sites are based on homograph letter. You can change the i,a,e which looks same as the actual one and it makes easy to target even very smart trader with a lot of experience. It's an old school method of phishing. Yes, those characters. It's old as it is but the sad thing is that there's still plenty of victims they get.
|
|
|
|
Lucius
Legendary
Offline
Activity: 3346
Merit: 5949
Crypto Swap Exchange🈺
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 03:58:39 PM |
|
Use link from post number 3 and report both link to Google, more reports will surely result in a quick reaction and both sites will be blocked in Chrome&Firefox which are the browsers with the most users these days. Another option is report them to registrar or domain provider, but from some personal experience it seems to me that they rarely react positively to such reports. Part of the responsibility is definitely on the hosting company, but as in the case of Google ads, it’s obvious that no one wants or can check things like this.
|
|
|
|
Baofeng
Legendary
Offline
Activity: 2702
Merit: 1672
DGbet.fun - Crypto Sportsbook
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 14, 2020, 10:47:16 PM |
|
Alternatively, you can report the abuse on the following: (1) https://www.namesilo.com/report_abuse.php(2) https://support.namecheap.com/index.php?/Tickets/SubmitReported both of them. From Namecheap: Your request has been received We have received your request and our team will get back to you shortly. You can log in to the helpdesk to review the status of your request, or check your email for further updates.
General Information Ticket ID #PWA-170-71983 First and Last Name xxxx Email xxxx Type Issue Priority High
From my experience reporting sites from both domain registrar, it usually took 2-3 before they take it offline. Crossing our fingers that no one will fall for this trick.
|
|
|
|
Chikito
Legendary
Offline
Activity: 2492
Merit: 2071
Exchange 250+ Coins With 0% Fees
|
Maybe try to subscribe dnstwister to avoid scam, see link below to know how much similar chipmixer domain. https://dnstwister.report/search?ed=636869706d697865722e636f6dWe identified 324 domains similar to chipmixer.com. 60 domains resolved to an A or MX record ![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.postimg.cc%2FkghGMLND%2Fg.png&t=665&c=AAC7o1DL7epFXQ) I find over 500+ on union https://dnstwister.report/search?ed=636869706d69786572777a78747a62772e6f6e696f6eWe identified 579 domains similar to chipmixerwzxtzbw.onion. No domains resolved to an A or MX record dns twisster will alarming you when new similar created. then report it.
|
| | TheChange | | | | |
░░░░░░░░░░██▄ ▄▄▄▄▄▄▄▄▄▄▄███▄ ▀▀▀▀▀▀▀▀▀▀▀███▀ ░░░░░░░░░░██▀ ░░░▄▄ ▄██▀ ███████████████ ▀██▄ ░░░▀▀ | | | | +250 COINS | | ..Crypto Exchange.. | │ | ▄▄▄▄ ▄▄▄███▀▀███▄▄▄ ▄█████▀▀░▄▄▄▄░▀▀█████▄ ██▀░▄▄▄████████▄▄▄░▀██ ██░████████████████░██ ██░████████████████░██ ██░▀██████████████▀░██ ██░▀████████████▀░██ ▀██░▀██████████▀░██▀ ▀██▄░▀██████▀░▄██▀ ▀██▄▄░▀▀░▄▄██▀ ▀▀██▄▄██▀▀ ▀▀▀▀ | | | │ | |
|
|
|
smyslov
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 15, 2020, 05:57:22 AM |
|
If you bookmarked the real Chipmixer site and you have a metacert extension or similar extension you are safe, not really surprising, it's one of the top mixing site in the business and hackers are making big bucks imitating or creating a phishing site.
|
|
|
|
Yaunfitda (OP)
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 18, 2020, 02:45:07 AM |
|
Quick Update:
The second website has been taken down already.
But namecheap is slow to react, I urge everyone to help the community by reporting the first website to them.
|
|
|
|
R |
▀▀▀▀▀▀▀██████▄▄ ████████████████ ▀▀▀▀█████▀▀▀█████ ████████▌███▐████ ▄▄▄▄█████▄▄▄█████ ████████████████ ▄▄▄▄▄▄▄██████▀▀ | LLBIT | | | 4,000+ GAMES███████████████████ ██████████▀▄▀▀▀████ ████████▀▄▀██░░░███ ██████▀▄███▄▀█▄▄▄██ ███▀▀▀▀▀▀█▀▀▀▀▀▀███ ██░░░░░░░░█░░░░░░██ ██▄░░░░░░░█░░░░░▄██ ███▄░░░░▄█▄▄▄▄▄████ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ | █████████ ▀████████ ░░▀██████ ░░░░▀████ ░░░░░░███ ▄░░░░░███ ▀█▄▄▄████ ░░▀▀█████ ▀▀▀▀▀▀▀▀▀ | █████████ ░░░▀▀████ ██▄▄▀░███ █░░█▄░░██ ░████▀▀██ █░░█▀░░██ ██▀▀▄░███ ░░░▄▄████ ▀▀▀▀▀▀▀▀▀ |
| | | | | | .
| | | ▄▄████▄▄ ▀█▀▄▀▀▄▀█▀ ▄▄░░▄█░██░█▄░░▄▄ ▄▄█░▄▀█░▀█▄▄█▀░█▀▄░█▄▄ ▀▄█░███▄█▄▄█▄███░█▄▀ ▀▀█░░░▄▄▄▄░░░█▀▀ █░░██████░░█ █░░░░▀▀░░░░█ █▀▄▀▄▀▄▀▄▀▄█ ▄░█████▀▀█████░▄ ▄███████░██░███████▄ ▀▀██████▄▄██████▀▀ ▀▀████████▀▀ | . ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ░▀▄░▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄░▄▀ ███▀▄▀█████████████████▀▄▀ █████▀▄░▄▄▄▄▄███░▄▄▄▄▄▄▀ ███████▀▄▀██████░█▄▄▄▄▄▄▄▄ █████████▀▄▄░███▄▄▄▄▄▄░▄▀ ████████████░███████▀▄▀ ████████████░██▀▄▄▄▄▀ ████████████░▀▄▀ ████████████▄▀ ███████████▀ | ▄▄███████▄▄ ▄████▀▀▀▀▀▀▀████▄ ▄███▀▄▄███████▄▄▀███▄ ▄██▀▄█▀▀▀█████▀▀▀█▄▀██▄ ▄██▀▄███░░░▀████░███▄▀██▄ ███░████░░░░░▀██░████░███ ███░████░█▄░░░░▀░████░███ ███░████░███▄░░░░████░███ ▀██▄▀███░█████▄░░███▀▄██▀ ▀██▄▀█▄▄▄██████▄██▀▄██▀ ▀███▄▀▀███████▀▀▄███▀ ▀████▄▄▄▄▄▄▄████▀ ▀▀███████▀▀ | | OFFICIAL PARTNERSHIP SOUTHAMPTON FC FAZE CLAN SSC NAPOLI |
|
|
|
TalkStar
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 18, 2020, 03:40:57 AM |
|
The second website has been taken down already.
That's great,,, I don’t know how many people have already lost their funds due to this kinda phishing sites but i am damn sure that these scammers will continue with another domain. But namecheap is slow to react, I urge everyone to help the community by reporting the first website to them.
As far as i know namecheap support system is quite good but due to heavy work loads sometime its require little bit extra time to take action from their end. Hope they will take proper action as soon as possible and definitely i will submit report from my side for drawing their attention on this matter and faster actions too.
|
|
|
|
Jating
|
![](https://bitcointalk.org/Themes/custom1/images/post/xx.gif) |
May 18, 2020, 10:36:58 AM |
|
Quick Update:
The second website has been taken down already.
But namecheap is slow to react, I urge everyone to help the community by reporting the first website to them.
Reported the second site in my end. So let's see, namecheap is one of the biggest domain registrar out there so they might be a lot of reports for them to review, specially that there are a lot of cyber criminals taking this opportunity to create Covid-related themes so it might take some time. So let's just wait and see how it goes. Thanks for the fair warning again.
|
|
|
|
|
|