Be Aware Fake Ads Electrum Wallet on Chrome

[Chikito]

hello newbie, don't search "electrum" on Google searching box, I warn you, Look at the image below;



when clicking that ads will direct into a fake Electrum website

Code:

https://elekclrum.org/#home

I use chrome, look this phishing only working with that browser.

So, don't use chrome anymore.

[AB de Royse777]

Well even with the official site, it is always advisable to verify the downloaded file before installing. This is the public key of ThomasV:

Code:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBE34z9wBEACT31iv9i8Jx/6MhywWmytSGWojS7aJwGiH/wlHQcjeleGnW8HF
Z8R73ICgvpcWM2mfx0R/YIzRIbbT+E2PJ+iTw0BTGU7irRKrdLXReH130K3bDg05
+DaYFf0qY/t/e4WDXRVnr8L28hRQ4/9SnvgNcUBzd0IDOUiicZvhkIm6TikL+xSr
5Gcn/PaJFS1VpbWklXaLfvci9l4fINL3vMyLiV/75b1laSP5LPEvbfd7W9T6HeCX
63epTHmGBmB4ycGqkwOgq6NxxaLHxRWlfylRXRWpI/9B66x8vOUd70jjjyqG+mhQ
+1+qfydeSW3R6Dr2vzDyDrBXbdVMTL2VFXqNG03FYcv191H7zJgPlJGyaO4IZxj+
+O8LaoJuFqAr8/+NX4K4UfWPvcrJ2i+eUkbkDJHo4GQK712/DtSLAA+YGeIF9HAn
zKvaMkZDMwY8z3gBSE/jMV2IcONvpUUOFPQgTmCvlJZAFTPeLTDv+HX8GfhmjAJY
T5rTcvyPEkoq9fWhQiFp5HRpYrD36yLVrpznh2Mx7B1Iy8Rq/7avadwVn87C6scJ
ouPu+0PF3IeVmYfCScbfxtx1FaEczm8wGBlaB/jkDEhx0RR8PYKKTIEM7T2LH2p6
s/+Ei4V7mqkcveF/DPnScMPBprJwuoGNFdx2qKmgCKLycWlSnwec+hdyTwARAQAB
tBlUaG9tYXNWIDx0aG9tYXN2MUBnbXguZGU+iQI4BBMBAgAiBQJN+M/cAhsDBgsJ
CAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAr1YJLf5Rw5hlhD/9T4I/sBCleS9nH
njTJqcOnG28c9C3CRYIizjEui/pKmXz9fB1N9QrCaruPUQx2UacDVCl6dKxac+7s
s3/a6lsjaRn0/2OM/sCVLScyxNPNPQs2b6jkodSNPIM8zv51g+flhwtfrO6h6B4j
IhZgSjFdvqtZd5jaly9rA0uMX045CC4K6HGnq8n4F2p31z0L0LaHBf5EcsCM0MMp
QVkY0aUrNg9uVMGXBHn3osHnOtQaODqcIbpa/OG+Tlt6pVOiDJ7i8TkpQKT7sOaM
VdL//TEoDIOC7qVCN82q2q/gtiBXbziaERVs/eU0O52aX5qUhXu3VIjXTp/riRim
R/f9BPB1dgDZbF2aPZ/rJm26v82ft7gP1Sf52E9MrAaZATTfI0/TUHXeBzN93EA9
xb6/ENAMTX74u+NjlynWPD+hl64eBzJ2ionZF1bJFTgBkMfRYnhllvleCjcq9YfX
md5HKCwtxfygBIujUQSwyUzn0f5DbVCJ7/B19bKdvHGSSBgBEjxqXWQskm2wc0In
ww63goZAGDQliKhIT8xnwOBbLkqSobq4tD9zpQyxvMA2rhy7/gfFRp7TTak7MZHf
lTJ37S5LvcWHm/ccWUZDUN7akoEDc+m6jX3uIEPMD3PQvcHhWv0amco3zDr1qb/+
rXM7TJKd7DPX0E2dRzKu6aYRMTbklbQhVGhvbWFzIFZvZWd0bGluIDx0aG9tYXN2
MUBnbXguZGU+iQI4BBMBAgAiBQJTQDaRAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIe
AQIXgAAKCRAr1YJLf5Rw5hOBD/9o/NqHLvjhrCfy6/SblSC/udV9ujFnvhZZZprb
r8Oe6GdMwfw+ktZd2nYb09KjxXYmGoZeZKmvCb0LoMKSVWgisH1rgzDzI6UzFL4b
pV2+PqCSiWaekfnBm+oHbGgJCuAXebGXjVL8JsvhAl0HQZzTA1RX0u8TEAHOxOI5
l+mXSN+cwVZuDMpt5v+JDyPGHM/KqaXCw1WJY50mqlan6/15XHilmvY/CaxmbXNH
ZOXucmPxyCTeiQTqyhHsIBb4RxWYCaUXv9+svriotv2HZpQ110NN09ml1K1kDlNL
Zh3jNqMsbImFArbN8GikjqhRBV3K77Np4lccnsBPllQMqqQULG7UshcQTatkmTMb
j2TQ0oQWEZt0uJmnmxgz18ijs6m2fJZhlH0QYVYOwUvK6GfAFluHwOZHIXonv8Ck
uTW+P90lOB/9ZnREZeYb2wlvV6fCTMHxptIbT31kbLTzu4KEI6+ShQXT+YAKiC5S
JC9heheaeApH3wcLiZJcCKYv6ubY+3Uf/EoXcqWywwpS/nWkSpMSYjq+V9xCcGHI
MZ4vZkiZ6OS5Mu739rgGfP7Yi3pqUYLIpUa5QiNOMEhPtWbj/oH5ldaZowwgZ4MK
2Mzxex8IhFppPtZgqJfu9NZQLICpxcd2hUe3XWvB+jcvboZ1p7RO7ax3Vo9zy1fy
YEFML7Q9VGhvbWFzIFZvZWd0bGluIChodHRwczovL2VsZWN0cnVtLm9yZykgPHRo
b21hc3ZAZWxlY3RydW0ub3JnPokCOAQTAQIAIgUCVMYFygIbAwYLCQgHAwIGFQgC
CQoLBBYCAwECHgECF4AACgkQK9WCS3+UcOZ7BQ//VJuRmM7kQd5DcJS76BKpMtKt
gUNV3hi2h8kNGtkIeKhpeiK+PeweFJCb0nQDiEYsg5Xd/l5ZwN34cqlhgaQ8uWBY
rmNnSYGECLrxejx6WTWHp2AtD9BXrj73HEox2abC0Bdky39aCTyuRhSzbFnV2unh
L7IarKqr5bat6ywFZWsOcaisEjWXlTSD/hYqnkRX8vnBZRnRgHyi1yOvHsXGFB3x
O+P7JUb4E7BVzVRDJzMgcBhY5vTZ4Mnc8eIplNVI1TaF2hmhmnezvRF6XNYV1Ew9
t2/HE85+DqIBikUWYPTTxJiWUOwxXP9dVOEmNTcAgVThvMN7W+WoF7//qcNKmbPI
DyGU5xb/MLNrM+MWfavtkHNqcY0+cFf27z4mOxd2eEMDVxN/Fhq0HipugMEawaZ0
G9xsF/rZBzKgpu7+SvqRqxUn36vNz59vDlBYEXSng6nJobUdNb6iHo/rpZ6ZYHKx
mzrK5ROpmKs6zpPTOn8Hw29jxx07auzEIVEa8hzZaiqTfwI9yBwzhFQwNxmNaKRE
adxosvU1VyTvaEVmMmTx227MF1qhwq9yrSXtmKZJGiHRzyL4B4vAGrf9uK9GwzS2
TlyksRdjapw6Cqp8sUB2PUzHqYNWs0wSsZuxwVt6JSD4N8vpYTTF00LONKe2oLhj
GNxpH+BV3SqMHXQl9Ki5Ag0ETfjP3AEQAL5LYJiX5S4PG891TMihejh5KVgc36/R
zgWYJkE26K855t+WdAa6spHKR1RmpTTsnaTXaC/bNxJZq+0vi9GKlw94twEueu0v
Cniinpy6AFeydveCi+qdr5XQ4hx1DY11kntGBL2wMOtrZ4oAeFnntHYcAMYaMBY5
p8gd3WVR2dgIvpOcezQBLwhoMHnN6A+JEQ27ZHcolwDO9ic+t4YAtl552DP1xKbc
T4D1JD0J6W6FbUJElOXReSjNGCuSLZZTsCzMg0P6RHwWUKtDvRKrK/M3Nh/L2EsW
5mAQnYps6a+hyVkVd9kLsogtHPE4xv33pzbDB5Yj+2zqdjYUqO/ODfkP+HjNRvyj
uHL6W3bjU6FnuJQXX4llskls4hlKDPawa3cuWnsdafouAZOxWwBlGysRZ7BaHOFE
TOlAeUN1EYfFrckcfkYzTX7NDA0S99aX730z/c9XrnqM52OO9LrSFRnYZ+K3M8z2
FFvo9/ZtqqTDH0/oH+ay0CwtowSovZUoljAQ8zmmi8CtPDFHg4srae8YxW4fetn7
QtP6rOVRwQCyP12LztC7oYGOectU5G9GkVDubNW48Vuex0/upP9RORjKN8atBroS
cmomR5hShxmgdJBy4I/TDkVFbZq/hRPSTAHgnciEC67TYhszzXP3nTn5/Ah0wCGC
d3HfiNX6G7MdABEBAAGJAh8EGAECAAkFAk34z9wCGwwACgkQK9WCS3+UcOaJRA//
dLHRBjeAkNbRsY5GNTWUZzXr3VC5vNqpwpP9rK4QTAmpl3iU5F+wsgMG78iS2XOV
+ijZA8KvishletQJoNMxS1PU4sA4Y34hYb61ptHs+PmwNpcdgjAX+mCh9xQ0816G
yIaXtxtxacJJW3K07fqKIkJjISPOyTLSd+wl1LtRE2fA67pMmpMHG8t+RPq1dp/e
3qp6L7jc6X3U+bn2m7u2cgEVbuAnSaKGoMSMnsd71Ltf1b6/DwvZz/HBttEgcgSm
PleHUVyBD4LDrcjTDK7zdEMw7b/cPBnu6CmTcogFEqvB4n9Yodo+4ij7AndUTz4J
j1p8vFlnHvhRg82MDfGUPJ+ujBjbYXROs+WAmaCQ8TgjZ3dAFNFrOqAbYu6QlY2x
fu7vj+ruc6ArdmBrOlsJFmNsxFRJfgdUug5JFIUN77GbjisHjWem8cY3szuyEke8
H2pi803CAuVtkaoNmNDHsEBieft34Zo0V+A/q2wkix3S9vyRjOKqhGrW30qxnV6Z
FexueWuO3qOQ0ZU5/TIH0kft2n45/RexeBq/Ip52zE1vEvTkQmBCfCGZmqTu+9Ro
8qsjecxVNxyVPlwhlimryiQ+dPaJYaOSfiwEEMh2MyV5c6t6qN9n6jFdiCLOlmmH
ZFA8xDodsofQEmlv+I/xyEZ7na6nxbpZVuPC3B0JFtY=
=sUYl
-----END PGP PUBLIC KEY BLOCK-----

Have it in your PGP list.

There are signatures against all f the version in the download page. Whichever you end up downloading, remember to verify the downloaded file. This was you feel 100% safe that you have the authentic client in your system.

[sujonali1819]

Does it actually related to chrome browser? I think it only related to google. It's not matter which browser you are using, if you use google search engine you will get the same result. right? Or I am wrong?

There are signatures against all f the version in the download page. Whichever you end up downloading, remember to verify the downloaded file. This was you feel 100% safe that you have the authentic client in your system.

yeah, but people who is aware of the signature, will not full into this trap. Most of the case newbie fall into this who are not aware much.

[nelson4lov]

~Snipped
I use chrome, look this phishing only working with that browser.

So, don't use chrome anymore.

As far as I know, Its not a chrome browser thing but a Google search issue. I have actually seen it on other browsers like Brave and Opera. Basically any browser with Google search aa the default search engine. What happens if phishers clones those sites and then put them up on top of Google search using services like Google Adwords.

The best way to stay safe in situations such as this isn't to stay away from Google Chrome. Instead:

- Manually verify all site addresses to ensure they match. Also, it's better to just bookmarks those sites so the next time you  want to check them out, you can do so from the safety of your bookmarks. Phishing will always be there. We just have to be wise about it.


I'm not really sure if there's a way to report/download those ads in Google search but it's better to be safe than sorry.

[mk4]

Does it actually related to chrome browser? I think it only related to google. It's not matter which browser you are using, if you use google search engine you will get the same result. right? Or I am wrong?

Yeap, it's Google search engine-specific, not necessarily Chrome-specific because it's a Google AdWords ad. So ads like these should appear regardless of browser if you're not using an adblocker[1](which everyone should. Like damn guys it's 2020).

[1] https://github.com/gorhill/uBlock

[aioc]

Another way to check is the alexa ranking I have installed Alexa toolbar so I can check the traffic stat phishing site will always have a very low traffic stats here is the real Electrum traffic stat This site ranks:
#58,288

of course besides checking the PGP.

[cryptowhitewalker]

This is a serious case! And it's still up there for hours, for a popular wallet like Electrum i can't imagine how many will fall for this

[Lucius]

cryptowhitewalker, this is nothing new, we certainly have dozens of fake Electrum sites every day that are advertised through Google Ads, but also through various crypto related advertising platforms and via Telegram, FB or Twitter. It is impossible to prevent scammers from doing this, since it is very easy and cheap to buy a domain+hosting and create an advertising campaign - so when surfing it is mandatory to use ad blocker, and when using social networks do not communicate with strangers.

The Internet is a dangerous place, adapt or become just another in a series of helpless victims.

[DdmrDdmr]

The effect should indeed not be browser related, but rathermore search engine based, unless other installed browsers have some sort of Ad blocking features running.

Strangely enough, if I access the fake domain right now, what I get is the real original domain. They seem to have temporarily redirected the traffic to the real site, probably to switch it back to their fake content at will.

I stumbled upon a site to see if a given web is being redirected. Note that I haven’t used this site before, so I’ll enclose it here in code tags:

Code:

https://www.redirect-checker.org/index.php

When I parametrize it with the fake url into the above webpage, I get the following result:

Result
https[colon]//elekclrum[dot]org/#home
302 Found
https[colon]//electrum[dot]org/
200 OK

Problems found:
You use a 302 redirect. This means, that the actually content is temporary not reachable and will come back soon. To use a 302 redirection for generally moved pages is a bad idea. Search engine bot might not follow it or handle it as temporary. For SEO this is also a bad idea, because no link juice will be transferred to the linked page.

Note: I changed dots for [dot] and the colon for [colon] above.

[cryptowhitewalker]

cryptowhitewalker, this is nothing new, we certainly have dozens of fake Electrum sites every day that are advertised through Google Ads, but also through various crypto related advertising platforms and via Telegram, FB or Twitter. It is impossible to prevent scammers from doing this, since it is very easy and cheap to buy a domain+hosting and create an advertising campaign - so when surfing it is mandatory to use ad blocker, and when using social networks do not communicate with strangers.

The Internet is a dangerous place, adapt or become just another in a series of helpless victims.

An eye opener, i appreciate your direct tipping on security-wise operations. Anyone can tell that scammers are really on a scamming rampage.

[AB de Royse777]

Another way to check is the alexa ranking I have installed Alexa toolbar so I can check the traffic stat phishing site will always have a very low traffic stats here is the real Electrum traffic stat This site ranks:
#58,288

of course besides checking the PGP.

Making a decision judging by the traffic of the site :-D
Interesting thought but I would say the most stupid idea :-P

Taking your idea anyone can make a site, put a fake file there and rank it on google. Have other contents so traffic will start flowing and you will find the page in the first page. You know you are downloading a fake wallet :-D

Anyway, always verify no matter what - if you want to stay safe with your crypto money.

[Chikito]

it seems only the chrome browser will direct me into fake elekclrum when I tried using Firefox, that link direct me into official electrum.

Link already dead. Thanks to people who have reported that link immediately.

Code:

Forbidden

You don't have permission to access / on this server.

[OcTradism]

- Search but remember to do double checks.
- Don't believe in any source, verify (links and wallet)
- How to Safely Download and Verify Electrum
- Bookmark or save links to spreadsheets for future use and try to remember important websites. Remember or not, always verify.

Electrum has wallet for mobile but get app download links from the official website, not search app from Apple Store or Google Play.

[Lorence.xD]

Another way to check is the alexa ranking I have installed Alexa toolbar so I can check the traffic stat phishing site will always have a very low traffic stats here is the real Electrum traffic stat This site ranks:
#58,288

of course besides checking the PGP.

That traffic tracker is a new for me, I have heard of similar sites that have this sort of function. I will check this one out, and I think this deserves a topic of itself because it can help you identify sketchy sites from the real one. The problem with the website mentioned is that it is an ad so we can't rule out that it really is a scam site because no one visits ads that much in my opinion, I am not saying that the site is legit too but with the mindset that every site traffic rank is the basis of legitimacy will be detrimental for sites that are overshadowed by scam site.

[Lucius]

An eye opener, i appreciate your direct tipping on security-wise operations. Anyone can tell that scammers are really on a scamming rampage.

In the past, in order to rob someone, you had to rob a bank, break into someone's house/apartment and something like that - and today thieves sit in comfortable armchairs in front of their computers, hiding behind VPN/TOR, figuring out ways to get hold of someone's crypto. The rules of the game have changed, and anyone who doesn’t realize how dangerous the internet is are in great danger. Crypto users are an extremely vulnerable category, and therefore one should never give up warning and educating new and existing users.

Of course, much of the responsibility for such scams lies with Google, which has no effective mechanisms to filter such ads, but all we can do is report such ads - which is actually the eternal game of cat and mouse.

[Coyster]

Of course, much of the responsibility for such scams lies with Google, which has no effective mechanisms to filter such ads, but all we can do is report such ads - which is actually the eternal game of cat and mouse.

Of course we can have some rights to blame Google for playing part in some of this scams by not doing a thorough security check of ads, by filtering them and removing the scams, but I believe more of the responsibility should be on the users, with dex crypto, users should be more careful on how they use the internet especially when their coins are in 'hot' storage.

This rule of thumb has been repeated times without number: always use official websites to search for wallets, exchanges etc and not through Google search. Imo, if more users will take up the responsibility of their funds, then we may never have to worry if Google filters their ads or not, cause everyone will go through the safe and secure process.

[Kong Hey Pakboy]

I tried using different browsers such as Mozilla Firefox and Opera Mini, and the results were the same when I tried to search the Electrum wallet on google. I think the reason why this phishing website is on the top maybe because many people had clicked on this site when they tried to look or search about Electrum. Sometimes, we should use a separate device when we tried to search our browsers because not all sites we see on Google are safe to visit.

[bob123]

hello newbie, don't search "electrum" on Google searching box, I warn you, Look at the image below;

Searching for a term on google is fine.
Not using an adblocker (like you do) is the problem as well as clicking on ads.

I'd recommend you (and every other person) to install an ad blocker.

So, don't use chrome anymore.

While people definitely shouldn't use google chrome, this is not the reason for that.
Without an ad blocker, you'll see those ads in every browser, not just chrome.

[taufik123]

Searching for a term on google is fine.
Not using an adblocker (like you do) is the problem as well as clicking on ads.

I'd recommend you (and every other person) to install an ad blocker.

Using an adblocker is indeed quite effective in blocking annoying advertisements and sometimes finding scam or phishing ads which are of course very dangerous. I've been using an adblocker for a long time and it's working well. The adblocker I use is a feature provided by the antivirus I use. This feature also detects which websites are safe to visit.

While people definitely shouldn't use google chrome, this is not the reason for that.
Without an ad blocker, you'll see those ads in every browser, not just chrome.

yups, not only the chrome browser, even all brochures will have the same impact if we click on the ad. Automatic ads will appear in all applications associated with the account used. so don't be afraid to use chrome. Security is in the users themselves.

[Asuspawer09]

I mean only newbies are gonna click something from an advertisement right? Especially when it comes to bitcoin wallets like Electrum.

It's always better to have a trusted source first before clicking something on the internet.

Still, even a simple antivirus or even the windows Security is detecting this as dangerous sites.