Pretending Binanace to Scam People!

[shasan]

What happened:: I have received an email which title is "Surprise! We have a gift for you!".
PM/Chat Logs:



Additional Notes: While I have kept my mouse on claim voucher it shows me

Code:

https://log.bntrace.com/bapi/composite/v1/public/message/view-url?_bEt=eyJhbGciOiJIUzI1NiJ9.eyJjdCI6ImEiLCJiIjoiMTAwMjA3MTAyNCIsInIiOiJodHRwczovL2FwcC5iaW5hbmNlLmNvbS9lbi9teS9jb3Vwb24_X2RwPUwzZGxZblpwWlhjdmQyVmlkbWxsZHo5MGVYQmxQV1JsWm1GMWJIUW1ibVZsWkV4dloybHVQV1poYkhObEpuVnliRDFoU0ZJd1kwaE5Oa3g1T1ROa00yTjFXVzFzZFZsWE5XcGFVelZxWWpJd2RscFhOSFppV0d0MldUSTVNV05IT1hVPSZ1dG1fY2FtcGFpZ249TmV3VXNlcl9HbG9iYWwmdXRtX2NvbnRlbnQ9RW1haWwrNyZ1dG1fbWVkaXVtPUVtYWlsJnV0bV9zb3VyY2U9Q1JNIiwicyI6IkNSTSIsInNlcSI6MTI0Nzc5NCwidHMiOjE2NjA4MDYzNDUwNjd9.ZMbiELl7LIuyGwm38N7BoHmijXz_FqOIrKmTLwLHUGg

Which seems to me that it will redirect m to login page and steal my login credentials.[/color][/b]

[1715224514]

1715224514

[1715224514]

1715224514

[1715224514]

1715224514

[1715224514]

1715224514

[Pmalek]

Which seems to me that it will redirect me to login page and steal my login credentials.

Yeah, that's the idea of it. That's why the redeem instructions ask you to log in to your Binance account and they made a big yellow claim button to make it easier for the victims. Ideally, even if you fall for this phishing attempt, there should still be a 2nd factor that protects you in the form of a code that is sent to Authy, Google Authenticator, or a similar app. And if you aren't using the same password across multiple sites/services, all the hackers would get is a password they can't do anything with.

The fake site could also have malware that infects your device and that's another concern. But I believe we are just talking about a simple phishing site here.   

[BitcoinGirl.Club]

I have received an email

The email address I used to buy Ledger Nano and to subscribed few crypto related sites and later those were hacked, I receive these kind of emails all the day. You need to learn to delete the emails.

Unfortunately, the hackers are making money from it from the amature internet users.

[robelneo]

What happened:: I have received an email which title is "Surprise! We have a gift for you!".
PM/Chat Logs:



Additional Notes: While I have kept my mouse on claim voucher it shows me

Code:

https://log.bntrace.com/bapi/composite/v1/public/message/view-url?_bEt=eyJhbGciOiJIUzI1NiJ9.eyJjdCI6ImEiLCJiIjoiMTAwMjA3MTAyNCIsInIiOiJodHRwczovL2FwcC5iaW5hbmNlLmNvbS9lbi9teS9jb3Vwb24_X2RwPUwzZGxZblpwWlhjdmQyVmlkbWxsZHo5MGVYQmxQV1JsWm1GMWJIUW1ibVZsWkV4dloybHVQV1poYkhObEpuVnliRDFoU0ZJd1kwaE5Oa3g1T1ROa00yTjFXVzFzZFZsWE5XcGFVelZxWWpJd2RscFhOSFppV0d0MldUSTVNV05IT1hVPSZ1dG1fY2FtcGFpZ249TmV3VXNlcl9HbG9iYWwmdXRtX2NvbnRlbnQ9RW1haWwrNyZ1dG1fbWVkaXVtPUVtYWlsJnV0bV9zb3VyY2U9Q1JNIiwicyI6IkNSTSIsInNlcSI6MTI0Nzc5NCwidHMiOjE2NjA4MDYzNDUwNjd9.ZMbiELl7LIuyGwm38N7BoHmijXz_FqOIrKmTLwLHUGg

Which seems to me that it will redirect m to login page and steal my login credentials.[/color][/b]

I am very particular on the email I've received I see to it to check the domain extension they are using on your post it shows the domain extension Binance.com which is surprising if this is a phishing email it makes me wonder why they've used the official domain, I just want to clear things to enlighten all of us I have bookmarked the real Binance domain and checking the link you posted

Code:

https://log.bntrace.com/bapi/composite/v1/public/message/view-url

it redirected to the real Binance.com which I bookmarked.

It seems it's a tracking code that many sites are using if they send newsletters I also want to be enlightened on this is this just a tracking code or a phishing email that redirected I want to read members' opinions so we can double-check and we all be educated on this.
Maybe it's better if we can ask Binance if they own this redirection link
I also check about emails to whitelist and the email is not mentioned in their address to whitelist

https://www.binance.com/en/support/faq/360000444531

I'm not saying our brother Shasan is wrong he is a trusted member here with a great contribution to busting scams and I have huge respect for him.

[BitcoinGirl.Club]

Code:

https://log.bntrace.com/bapi/composite/v1/public/message/view-url

it redirected to the real Binance.com which I bookmarked.

If the URL takes to the real Binance domain then there are nothing wrong with it. In email marketing of any kind of marketing using tracking link even with having an external domain is a regular practice. Reading the domain "bntrace", I can translate it to "Binance Trace".

May be this is not a phishing case. OP overlooked at it.

[Potato Chips]

Upon checking, I don't think it's phishing as well. According to binance's handles authenticator, see: https://www.binance.com/en/official-verification both <do_not_reply@mailersp1.binance.com> and <bntrace.com> are theirs + as robelneo pointed out, the final link is indeed binance.com which can be checked in any URL redirect checker.

Still, I would only click link/s in emails when necessary and this time, it's not.

[robelneo]

Upon checking, I don't think it's phishing as well. According to binance's handles authenticator, see: https://www.binance.com/en/official-verification both <do_not_reply@mailersp1.binance.com> and <bntrace.com> are theirs + as robelneo pointed out, the final link is indeed binance.com which can be checked in any URL redirect checker.

Still, I would only click link/s in emails when necessary and this time, it's not.

Thank you for verifying my investigation Shahan might have overlooked it as @BitcoinGirl.Club stated there's no mistake on this I still encourage Shahan to keep posting phishing emails and scams, the link verifier you posted will also help us to check communication coming from Binance I have bookmarked it for future reference, I encourage members to do the same. 

[Beparanf]

I might be a victim on this kind of scam if I don’t see this post warning. I’m regularly receiving this kind of email from official binance email address and claiming it without any further verification. I’m not aware that there is scam scheme like this that copies Binance promotion email. I sometimes encounter re-login once I click Binance promotion but so far my account is still safe.

I think I should start resetting now my account credentials and check my emails just to make sure I’m receiving official email. Thanks

[16xypjnxlrew]

So did you get your gift or not?

[coin-investor]

So did you get your gift or not?

The answer is obvious he treats that email as a phishing email so he declines to login coming from that link,
based on the conversation we need to know if the validity of the emails really comes from legit sources we can always bookmark the site or just login directly without using the link or ask support if they own the link.
There's too much hacking and phishing going on, we need to protect ourselves by educating ourselves.

[ScamViruS]

So did you get your gift or not?

The purpose of the sender of this email is to steal the account information of the binance user through phishing links. So there is no question here of getting the gift, rather the op realized it at the right time and saved himself from this scam. Before opening any email, verifying the email address is more important than the sender's name. And if you analyze the information of the op, you will see that email address is not of binance.

[BitcoinGirl.Club]

The purpose of the sender of this email is to steal the account information of the binance user through phishing links. So there is no question here of getting the gift, rather the op realized it at the right time and saved himself from this scam. Before opening any email, verifying the email address is more important than the sender's name. And if you analyze the information of the op, you will see that email address is not of binance.

It was not a phishing email after all. OP was overlooking at like some of us did before but later it was clear that the link was tracking to real Binance account. It was just a different domain to help them tracking the marketing.

[ScamViruS]

The purpose of the sender of this email is to steal the account information of the binance user through phishing links. So there is no question here of getting the gift, rather the op realized it at the right time and saved himself from this scam. Before opening any email, verifying the email address is more important than the sender's name. And if you analyze the information of the op, you will see that email address is not of binance.

It was not a phishing email after all. OP was overlooking at like some of us did before but later it was clear that the link was tracking to real Binance account. It was just a different domain to help them tracking the marketing.

I also checked and you are correct. But it is surprising why binance will do this kind of activity officially, because it will confuse crypto users. I myself would not be interested in clicking any such link. However, after reading the details, I realized that it is not dangerous for crypto users.

[BitcoinGirl.Club]

I also checked and you are correct. But it is surprising why binance will do this kind of activity officially, because it will confuse crypto users. I myself would not be interested in clicking any such link. However, after reading the details, I realized that it is not dangerous for crypto users.

It's a normal thing for digital marketing. It's us bitcointalkers who are kind of paranoid LOL. But it's good to be careful though especially when you are a crypto user and you wallet is in the same device which you are using all the time.

I usually keep a file for all the service sites I use and always visit their website from the links. I avoid any form of emails and links from any other channels. If I need to check the service offer then I login using my saved link and try to check the appropriate section of the site. This way I feel safer.

[JollyGood]

What happened:: I have received an email which title is "Surprise! We have a gift for you!".

Thank you for posting about this. The only reason the scammers use these types of email scams is because somewhere along the line there are a sizeable number of gullible people who end up clicking the links and enter their credentials. This will inevitably lead to their account getting hacked.

So did you get your gift or not?

Is your question really to be taken seriously?

[bitbollo]

What happened:: I have received an email which title is "Surprise! We have a gift for you!".

Thank you for posting about this. The only reason the scammers use these types of email scams is because somewhere along the line there are a sizeable number of gullible people who end up clicking the links and enter their credentials. This will inevitably lead to their account getting hacked.

So did you get your gift or not?

Is your question really to be taken seriously?

Yes these time this question should be taken seriously just because It's not an email scam... I have just verified and the url redirect to binance.com as already pointed out by @robelneo.

Code:

https://log.bntrace.com/bapi/composite/v1/public/message/view-url

However they can just "confuse" people by sending email with such strange url domain. People can make errors and maybe trust the wrong message
It would useful if they will add some sensitive information (like Name or Surname) of account owner or/and clear instructions to login directly in OFFICIAL URL! without using these secondary urls... there are pixels that can track emails, I don't think they need even special URLs....

[16xypjnxlrew]

Is your question really to be taken seriously?

Yes, I seriously ask him! I also receive letters from the Bybit exchange and that also uses a third -party domain to track and they don't even include HTTPS, use HTTP to track. Why is he afraid to receive this gift, because the letter came from the official Binance domain. It can't be faked in any way means all the links that they sent can't be malicious

[JollyGood]

However they can just "confuse" people by sending email with such strange url domain. People can make errors and maybe trust the wrong message
It would useful if they will add some sensitive information (like Name or Surname) of account owner or/and clear instructions to login directly in OFFICIAL URL! without using these secondary urls... there are pixels that can track emails, I don't think they need even special URLs....

Well if the email sender is using a different domain or suspicious looking subdomain then it raises questions 

About pixels and tracking, this technique is used widely by businesses but many people are not even aware such a tracking mechanism even exists. The amount of data being generated then sent to the tracker whenever the email is opened must be important to them otherwise they would not bother.

Yes, I seriously ask him! I also receive letters from the Bybit exchange and that also uses a third -party domain to track and they don't even include HTTPS, use HTTP to track. Why is he afraid to receive this gift, because the letter came from the official Binance domain. It can't be faked in any way means all the links that they sent can't be malicious

Did you collect your free gift, if you did what was it?

[coin-investor]

What happened:: I have received an email which title is "Surprise! We have a gift for you!".

Thank you for posting about this. The only reason the scammers use these types of email scams is because somewhere along the line there are a sizeable number of gullible people who end up clicking the links and enter their credentials. This will inevitably lead to their account getting hacked.

So did you get your gift or not?

Is your question really to be taken seriously?

Yes these time this question should be taken seriously just because It's not an email scam... I have just verified and the url redirect to binance.com as already pointed out by @robelneo.

Code:

https://log.bntrace.com/bapi/composite/v1/public/message/view-url

However they can just "confuse" people by sending email with such strange url domain. People can make errors and maybe trust the wrong message
It would useful if they will add some sensitive information (like Name or Surname) of account owner or/and clear instructions to login directly in OFFICIAL URL! without using these secondary urls... there are pixels that can track emails, I don't think they need even special URLs....

They are not the only ones doing this, all sites with memberships and affiliates have this, the tracking is a means to track the behaviors of their users, the tracking can tell them how many of their members received their emails open and accept the offers, it's for future reference so they can update or upgrade their service to better serve their members and their clients.

[16xypjnxlrew]

Did you collect your free gift, if you did what was it?

No Bybit exchange isn't as generous as Binance, they only send advertising e-mail's (we added a new futures contract)