[Warning]: Fake Wasabi Wallet website

[Yaunfitda]

We all know that Wasabi wallet has slowly gaining some ground as of late being one wallet that you can use if you really wanted anonymity. So this website suddenly popups, copy the exact image of the original wasabi website:

So please be careful:

Fake Website:

Code:

https://wasabi-wallet.io/

Original Website: https://wasabiwallet.io/

And if you go and check the original website, the fake website is literally a exact and replica copy.

Whois details of the fake site, just created in May 2020. While the original site https://whois.domaintools.com/wasabiwallet.io, was created 2018-04-26.

Fake Site:

Domain Name: WASABI-WALLET.IO
Registry Domain ID: D503300001185442344-LRMS
Registrar WHOIS Server: whois.namecheap.com
Registrar URL: www.namecheap.com
Updated Date: 2020-05-18T14:35:10Z
Creation Date: 2020-05-17T17:10:27Z
Registry Expiry Date: 2021-05-17T17:10:27Z
Registrar Registration Expiration Date:
Registrar: NameCheap, Inc
Registrar IANA ID: 1068
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone: +1.6613102107
Reseller:
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Registrant Organization: WhoisGuard, Inc.
Registrant State/Province: Panama
Registrant Country: PA
Name Server: DNS1.NAMECHEAPHOSTING.COM
Name Server: DNS2.NAMECHEAPHOSTING.COM
DNSSEC: unsigned

[BitcoinGirl.Club]

It's always recommended to verify. I am using Wasabi from last 24hours lol but before doing anything else I was looking for their signature if they have one. When I found one then I decided to install it in my system. These fake people will always try to rip the newbies.

[Jating]

It's always recommended to verify. I am using Wasabi from last 24hours lol but before doing anything else I was looking for their signature if they have one. When I found one then I decided to install it in my system. These fake people will always try to rip the newbies.

Yes, we really need to verify everything first.

Here is guide from Wasabi itself. GPG verification and public-PGP key.

https://github.com/zkSNACKs/WalletWasabi/blob/master/WalletWasabi.Documentation/Guides/InstallInstructions.md#gpg-verification

[hd49728]

The official website has a Doc tab that gives some documents to check integrity of wallet and verify it.

Verify the integrity of your software

When installing the wallet, you may choose to download the package from the official clearnet or the tor hidden service , or to compile the source code from the official GitHub repository Please verify the signatures after completing downloads. The concern here is that you may accidentally fall for a phishing attempt and be on a malicious site downloading a malicious piece of software.

How can I verify PGP signatures

On the WasabiWallet.io

website you can download the packages of the latest release. Make sure that in addition you also download the separate signature .asc file. In the terminal, change the directory to the one with the downloaded files, and verify the signature with gpg --verify Wasabi-1.1.11.1.deb.asc. Everything is valid if it returns Good signature from zkSNACKs and that it was signed with the Primary key fingerprint: 6FB3 872B 5D42 292F 5992 0797 8563 4832 8949 861E.

For an in-depth guide for Debian and Ubuntu, other Linux, Windows, and macOS see the main documentation.

Some topics on phishing
What to do to avoid phishing sites
Host-file to deal with phishing sites

Read more:
- Tampering attacks!
- Punnycode attacks
- [LEARN] Phishing Quizzes - Beginners & Experts

[pakhitheboss]

Hey! Thanks for the heads up. It is true wasabi wallet is getting a lot of new user because of its privacy feature.

Every fake website can be identified if we check the url but, most of us if ore that fact. It is very important that we always keep a check on the url where we are visiting a small given or dot are always used by these spammers when they create a copy website.

[OcTradism]

Wasabi wallet will have some troubles with law enforcement and regulation. There is a report from Europol. [2]

Europol, the European Union’s law enforcement agency, has its eyes on the popular bitcoin privacy tool Wasabi Wallet, documents verified by CoinDesk show.  

[1] https://www.coindesk.com/europol-bitcoin-privacy-wasabi-wallet
[2] https://www.coindesk.com/wp-content/uploads/2020/06/1_5096130532387848318.pdf

[khaled0111]

Thank you for the warning OP. Likely, the phishing link doesn't appear in google search result yet when you search for "wasabi wallet". However, the first result I get is an ad for sudokuwallet website!
Downloading the gpg signature file and verifying the authenticity of downloaded files is a must and anyone who cares about his security should learn how to do it and make it a regular practice.

[sheenshane]

Thank you for sharing this information here OP.

I saw this clickbait phishing link that pretending the real wasabi wallet posted on Reddit last month maybe they are the same link as what OP shared.

And also there someone who shared here on the forum last year, a Fake Wasabi wallet from wasabibitcoinwallet [dot] org.

snipped-
..anyone who cares about his security should learn how to do it and make it a regular practice.

I tend to agree and this is the best practice to avoid this kind of trap!

[TalkStar]

We all know that Wasabi wallet has slowly gaining some ground as of late being one wallet that you can use if you really wanted anonymity. So this website suddenly popups, copy the exact image of the original wasabi website:

Scammers always run after well reputed platforms where by creating phishing websites they try to take the advantage of established platforms registered users and fame. Its because sometimes people don't care about url address and make the mistake by clicking on this kinda phishing website. You will easily get so many victims who lost their fund due to this kind of trap.   

You can contact Wasabi wallet real authority and let them know about this phishing website. Hope they will notify their regular users about this.        

[Swordsoffreedom]

It is important to verify the files signature before running any kind of file on your system, and it is recommended keep up to date your antivirus engine regularly. You can report about this fake website on "Google Safe Browsing". Already I've reported about it, hope they will take an effective action against this fake website.

[coupable]

Nice catch op. Thanks for pointing this out.
Fortunetly, there is no similar domains to https://wasabiwallet.io/ according to dnstwister but the one mentioned in op and another which is not active:

Code:

wasabiwall.et.io

DNStwister report: https://dnstwister.report/search?ed=77617361626977616c6c65742e696f

I have already report the fake link to google safeBrowsing, and i wish others to do so.
I have also reported this in the official ANN of wasabi wallet here in the forum here: https://bitcointalk.org/index.php?topic=5064006.0

[Cointikka]

Good to know information. Thanks for sharing.

There are a lot of fake website out on the internet and it is better to report such websites to google so that others also do not get scammed. I have reported the URL to google and you too can.

Go to this link - https://www.google.com/webmasters/tools/spamreport

click on the button that says Report web spam and follow the instruction. This will not only stop google from indexing the website but will also raise an alarm if someone directly goes to the website using Google Chrome.

[Twinkledoe]

Domain name is a good choice to imitate the original wasabi wallet. They just added hyphen and presto, they can start scamming people. I really hope crypto users who are using this kind of service will be more vigilant with the sites that they are visiting. Also, can we see this thread in the Scam Accusations board?

[Chikito]

Domain came from

Code:

naseg.top

regarding from gist github about that's IP > https://gist.github.com/ANeilan/b66feefc03dc4c17d0b7d16ca4158374
Has red tag


when checking relationship, https://www.virustotal.com/gui/ip-address/199.188.200.245/relations IP's has connected into HYIP site

Code:

https://www.slushminer.ltd/

And many more,

Usually, scammer created domain by renting VPS/IP for scam purposes.

[nopara73]

I'm in this 2 day cycle for a month already:

Day 1: Google "wasabi wallet", notice and report fake ad (https://support.google.com/google-ads/troubleshooter/4578507)
Day 2: Google "wasabi wallet" and  acknowledge the fake ad is removed.
Day 3: Rinse and repeat.

[KrisAlex18]

Thanks for sharing that kind of information mate, there are many users of the legit wasabi website, so there are always hackers trying to create a copy for that website because of its number of users. To avoid being scammed by the fake websites, you should know how to identify fake and legit websites, there are many fake websites, I had already found one and it scammed my 0.01 BTC because of not being aware of the fake and legit website. There are always differences between fake and legit websites, you should be observant to identify the differences, try to look at the colors, features, and the text of the website. For you to know the legit website, you may visit their page.

[notblox1]

I see this fake Wasabi website is till active.
Best thing we can do is to inform original Wasabi developers, so they can try to report them.
Is there something we can do to as regular users?


https://safebrowsing.google.com/safebrowsing/report_phish/

[Kemarit]

I see this fake Wasabi website is till active.
Best thing we can do is to inform original Wasabi developers, so they can try to report them.
Is there something we can do to as regular users?

Just look at the post above you, nopara73. He is the developer of Wasabi and is aware of this site and I'm sure he has reported it as well.

All we can do is wait till this fake website is taken down. But I do agree that we need collective efforts to report this phishing site.

[SFR10]

Is there something we can do to as regular users?

But I do agree that we need collective efforts to report this phishing site.

In addition to solutions posted by its developer and other users for getting rid of the fake one, most registrars have a system in place for combating such things and since that scammer used NameCheap, then you can try the following:
^{- Other users should report it as well.}

We can do that on Namecheap ^{[its registrar]} > Submit a ticket > Abuse Reports ^{[from the choices]} > Fraud / Phishing > Submit the following things.
^{- More information.}

[AakZaki]

Thanks for sharing that kind of information mate, there are many users of the legit wasabi website, so there are always hackers trying to create a copy for that website because of its number of users. To avoid being scammed by the fake websites, you should know how to identify fake and legit websites, there are many fake websites, I had already found one and it scammed my 0.01 BTC because of not being aware of the fake and legit website. There are always differences between fake and legit websites, you should be observant to identify the differences, try to look at the colors, features, and the text of the website. For you to know the legit website, you may visit their page.

the most dangerous is when fake websites use the same spelling, but only different types of letters such as the difference in the letters "a" and the letters "á" with quotation marks above. This will trap and will look the same. the safest way is to save the original website by bookmarking and analyzing in advance whether the website is authentic or a fake website. There are so many fake or fake websites nowadays, you should be more careful and always be vigilant.