New Airdrop scam detected

[posi]

I received this message from an email address which starts with "ntradingbot" the message contain Stellar airdrop announcement
Note : I covered the scammer email in other not to break the doxing rules stated by Theymos.



I did some few background check and I find out that 35% of the words wrote by the scammer behind the airdrop are draft from previous Stellar airdrop organized by blockchain.com which is clarified in the below image.







Went through their site, they didn't request for any fund but they ask people to download a Stellar rar app which is not from a trusted source and purposely to steal from people.



Scammer website : https://stellar-limited.com/
Archived link : http://archive.is/vrbCd

Link the scam spreadsheet : https://docs.google.com/forms/d/e/1FAIpQLScf0GbjEW7iDDA3Igm1W-SZ2VFpFrgtdCwpdRJxkI_PAC8w1g/viewform
Archived link : http://archive.is/ToDo4


Link to blockchain.com previous airdrop which was plagiarized :
https://support.blockchain.com/hc/en-us/articles/360019105951-How-to-participate-in-the-Stellar-airdrop

Scammer site domain age :



I later wrote the stellar admin on twitter about the airdrop to be assured if my detection is right and this is he said

[madnessteat]

I thought that every e-mail user and especially the crypto enthusiast knows that 99.9% of emails coming from strangers to his or her email box are fraudulent. It's very strange that you still believe in spam mailings in 2020.

[khaled0111]

I wanted to visit the scammer's website to download the app and scan it (despite being 100% sure it's a malware) but it seems to be down. Not sure whether it was temporarily disabled or someone reported it and was removed for good!

From the email used by the scammer, it looks like airdrops is not his only scamming technique. I wouldn't be surprised if he sends you another email asking you to download a trading bot 

[Twinkledoe]

I wanted to visit the scammer's website to download the app and scan it (despite being 100% sure it's a malware) but it seems to be down. Not sure whether it was temporarily disabled or someone reported it and was removed for good!

It is good that they are already down to prevent naive users or newbies from being a victim of this scam site. If only people that found a specific site a scam will report it immediately, we will lessen these scammers from further screwing users of their dirty tactics.

[GreatArkansas]

I am a little bit curious that how they were able to get your email address in the first place?
Rather if you did not share your email address to anyone especially those some cryptocurrency airdrops that required an email address to participate or subscribing to some newsletter of cryptocurrency news providers or any.
Because for me, this kind of email becomes normal, I also received this kind of email.

[robelneo]

I thought that every e-mail user and especially the crypto enthusiast knows that 99.9% of emails coming from strangers to his or her email box are fraudulent. It's very strange that you still believe in spam mailings in 2020.

I never trust personal emails that I never opt to subscribe, it's bad marketing and unethical, that is why Gmail is flagging these kinds of mass email services, I never bother to read the whole content I just move it to spam if it landed in my main folder and I never read anything that is on my spam unless I expect email coming from sites that I trust.

[jademaxsuy]

I am a little bit curious that how they were able to get your email address in the first place?
Rather if you did not share your email address to anyone especially those some cryptocurrency airdrops that required an email address to participate or subscribing to some newsletter of cryptocurrency news providers or any.
Because for me, this kind of email becomes normal, I also received this kind of email.

My guess is that op must have use an email on different platform many timdes and might have been used to some site that is scam unless the op use a dummy email or the site that op visited before might get compromised because of hacking due to lack in security of the site. I agree with ETFbitcoin that your email is already exposed to scammers.

[CucakRowo]

Oh my.. scammer/frauders will not stopping their activities to get money by scamming people.
I receive that kind of email around 4-5 months ago. But not from Tradingbot news.. i got an email from shady exchange, sorry i forgot the name. Coz when i receive that kind of email, 100% i will send it to trash folder immediately.

[Assface16678]

Getting a message from email came from unknown users it is just quite suspicious because you do not expect a message came from other users or businesses. This kind of action must not need to click it because we want to avoid getting troublesome of the emails when open triggers access to your account. Also, one thing I got curious is how they know your email or you fill up some form that's why they get your information like your email. It is better if we are avoiding using our main email because it may cause of spam to your inbox even we have a report thread on our email to mark as spam.

Getting email into unknown source is absolutely scam. If you want to know it is better we search first to identify because of lacking information.

[JohnBitCo]

I wanted to visit the scammer's website to download the app and scan it (despite being 100% sure it's a malware) but it seems to be down. Not sure whether it was temporarily disabled or someone reported it and was removed for good!

From the email used by the scammer, it looks like airdrops is not his only scamming technique. I wouldn't be surprised if he sends you another email asking you to download a trading bot 

Why did you even tried to visit the the scammer site ? Do you know they might have trogans or malwares on their sites/app which can affect your system or mobile. They may be able to hijack your system or your coins. I never visit any unknown site specially if i get such an email to visit the site and get $$$$.

[Chikito]

I wanted to visit the scammer's website to download the app and scan it (despite being 100% sure it's a malware) but it seems to be down. Not sure whether it was temporarily disabled or someone reported it and was removed for good!

Seem was reported, No IP and no DNS found. Check it here https://mxtoolbox.com/SuperTool.aspx?action=a%3astellar-limited.com&run=toolpage#

Why did you even tried to visit the the scammer site ? Do you know they might have trogans or malwares on their sites/app which can affect your system or mobile. They may be able to hijack your system or your coins. I never visit any unknown site specially if i get such an email to visit the site and get $$$$.

No problem if using a virtual machine or Sandboxie.

[madnessteat]

I never trust personal emails that I never opt to subscribe, it's bad marketing and unethical, that is why Gmail is flagging these kinds of mass email services, I never bother to read the whole content I just move it to spam if it landed in my main folder and I never read anything that is on my spam unless I expect email coming from sites that I trust.

I don't even move such e-mails to spam, it's a waste of time because it won't eradicate cheaters. Tomorrow they will register new mail, change the text of the letter a little and continue their dirty business.

[Robust Crypto]

I received this message from an email address which starts with "ntradingbot" the message contain Stellar airdrop announcement
Note : I covered the scammer email in other not to break the doxing rules stated by Theymos.



I did some few background check and I find out that 35% of the words wrote by the scammer behind the airdrop are draft from previous Stellar airdrop organized by blockchain.com which is clarified in the below image.







Went through their site, they didn't request for any fund but they ask people to download a Stellar rar app which is not from a trusted source and purposely to steal from people.



Scammer website : https://stellar-limited.com/
Archived link : http://archive.is/vrbCd

Link the scam spreadsheet : https://docs.google.com/forms/d/e/1FAIpQLScf0GbjEW7iDDA3Igm1W-SZ2VFpFrgtdCwpdRJxkI_PAC8w1g/viewform
Archived link : http://archive.is/ToDo4


Link to blockchain.com previous airdrop which was plagiarized :
https://support.blockchain.com/hc/en-us/articles/360019105951-How-to-participate-in-the-Stellar-airdrop

Scammer site domain age :



I later wrote the stellar admin on twitter about the airdrop to be assured if my detection is right and this is he said

Thanks a lot for the info! Almost became victim of it.

[posi]

I thought that every e-mail user and especially the crypto enthusiast knows that 99.9% of emails coming from strangers to his or her email box are fraudulent. It's very strange that you still believe in spam mailings in 2020.

I never trust personal emails that I never opt to subscribe, it's bad marketing and unethical, that is why Gmail is flagging these kinds of mass email services, I never bother to read the whole content I just move it to spam if it landed in my main folder and I never read anything that is on my spam unless I expect email coming from sites that I trust.

You guys are both right about not trusting emails sent from strangers but if you're used to Stellar network you'll know that there's a chance for a lot of people to believe in the airdrop message because Stellar belong to more than 5 wallets/main net exchange providers and i believe there's a chance that this will increase in future. However, if I'm aware of the necessary precaution steps what about the newbies?
This is the reason why i shared this message on this board and #15 post should be enough to make you understand.

[Charles-Tim]

As for me, even if I want to claim airdrop, I will like it to be from the exchange i am using which is regulated. As for airdrops through email, I would have known it is fake, I will not even check the email not to talk of clicking on any malware a link in the email may contain.

[khaled0111]

I wanted to visit the scammer's website to download the app and scan it (despite being 100% sure it's a malware) but it seems to be down. Not sure whether it was temporarily disabled or someone reported it and was removed for good!

Seem was reported, No IP and no DNS found. Check it here https://mxtoolbox.com/SuperTool.aspx?action=a%3astellar-limited.com&run=toolpage#

thank you for the link DroomieChikito, I was too lazy to check it myself.
Now let's see how much time it will take him before he registers a new domain. (at least this will slow him down)

No problem if using a virtual machine or Sandboxie.

Exactly, I either use a VM or my old PC which I use as an experimental box. I would never open a suspecious link on my main computer.

[ScamViruS]

I also received a mail like this a few days ago. I also posted after receiving the mail. I thought it was important to warn others. They intend to hack the wallet by showing the greed of this huge airdrop. Those who do not know about this and are always in airdrop hunting can be the victims of such scams. Because they have arranged it in such a way that it is dangerous for those who do not know how to verify scams. And the scams are mostly targeted at newbies.

[Warning] Stellar (XLM) phishing website and virus file on the website.

[ShowOff]

Thanks a lot for the info! Almost became victim of it.

Why do you quote the entire post if you say thank you and tell us that you almost became a victim. Please edit your post.


OP, for some things I just want to suggest that you can disable sitelinks like using code like a phishing site reporter did. This can help users prevent and improve their security if the scam site has been compromised by a virus or malware.

My email inbox is also full of fraudulent attacks that keep sending me links. My preventive step is never to click on any link even if I am just curious. This is a step to improve the security of your assets and account. We don't need to trust the people who send us emails except only if they are the people we contacted before.

[Krislaw]

I receive this almost everytime(on of my temporary email), yesterday it was ETH, today it's XLM. I don't know what's going to be tomorrow, maybe Satoshi himself will send me an email or something.

Best thing to do is to create a different email address for filling, don't send any funds to any projects that asks you for funds for you to receive your reward, ignore links in your email that look like spam.

[gundala]

Sometimes, the scammer makes emails as close as possible to the original project. I often get emails like that in the name of one of the top exchanges. After I checked the exchange, there wasn't any information about airdrop or giveaway like in the email. For newbie, getting an email like that would be considered legit. We should first verify the truth by visiting the official website of the project.

~

Best thing to do is to create a different email address for filling, don't send any funds to any projects that asks you for funds for you to receive your reward, ignore links in your email that look like spam.

That's the best way so that the main email that we use for important activities doesn't appear publicly. I made several emails with their respective functions.