new Electrum phishing site

[cygan]

Electrum warns with this official tweet about a new phishing website called: electrumcore dot org
Please always pay attention to which links you click on and in the best case always type the official URLs into the browser bar yourself


https://twitter.com/ElectrumWallet/status/1667401981671948297?t=ClXTIrkb1NLe16j4fMhboA&s=19

[1714660653]

1714660653

[1714660653]

1714660653

[1714660653]

1714660653

[1714660653]

1714660653

[BitcoinGirl.Club]

Electrum warns with this official tweet about a new phishing website called: electrumcore dot org

Well it is electrum.org so everything else are phishing sites. One of the best practice is to save the URL somewhere safe or bookmark it then visit the site. Risk of phishing attack becomes minimal then.

But it's a good Tweet to aware the community.

[Maus0728]

Well it is electrum.org so everything else are phishing sites. One of the best practice is to save the URL somewhere safe or bookmark it then visit the site. Risk of phishing attack becomes minimal then.

And to use uBlock Origin extension on your browser. In my experience, changing your search engine into a more privacy oriented one could help as well in avoiding these phishing sites appearing on your browser.

[yhiaali3]

Thank you for the warning, this is not the first Electrum phishing site.

For me, always when I want to update or visit the Electrum Wallet website, I go to the site via the link in the wallet program itself, for fear of visiting a phishing site by mistake.

It is best to save these important sites such as exchanges and wallets in your favorites or a small notepad file containing all the links.

[o_e_l_e_o]

Bookmarking the official site or only visiting the site via the software is not foolproof. There is nothing stopping an attacker from compromising the official site and uploading malicious software there.

You should be verifying all the software you download, regardless of where you download it from.

[Aikidoka]

Much appreciated for the warning! I believe there are many phishing sites targeting Electrum users. Therefore, it is really important for anyone intending to use this wallet to verify the authenticity of the software they download to ensure that they obtain the correct version and not the fake/malicious one.

Well it is electrum.org so everything else are phishing sites. One of the best practice is to save the URL somewhere safe or bookmark it then visit the site. Risk of phishing attack becomes minimal then.

And to use uBlock Origin extension on your browser. In my experience, changing your search engine into a more privacy oriented one could help as well in avoiding these phishing sites appearing on your browser.

I do have this extension, and it's actually really good so far. It helps to avoid a lot of phishing sites as well as annoying ads. I've been using it for a while now.

[BitcoinGirl.Club]

You should be verifying all the software you download, regardless of where you download it from.

Verifying the file signature is the best practice but pretty sure there are many who do not have any idea how PGP works and how to deal with Kleopatra or such type of software. So assuring someone on the official site is the first step of many security measurements in my opinion.

And to use uBlock Origin extension on your browser. In my experience,

I never heard of it nor used it. On the other hand I think I have trust issue with browser extension type software. I don't even use MetaMask, only used to do some testing and things but never used it for serious crypto handling.

[BitMaxz]

The owner of the site might be confused about the domain name he combines both bitcoin core and Electrum. This is not the only phishing site of Electrum there are many, people who already know the exact URL/website would not fall into this trap except for newbies that do not know how to verify, scan and check the downloaded Electrum.

I don't think using a plugin such as Ublock would help much but for me knowledge is the best to avoid phishing sites.

[khaled0111]

If I advice one of my friends to download Electrum and use it as it's main wallet. The first thing my friend would do is to look up Electrum on google! The first few results are hishing/fake pages.
Let's be honest, how many of us do verify the file signature befaure installing it!
I'm convinced that 90%, if not more, have installed Electrum without verifying it's signature.

[Sarah Azhari]

Electrum warns with this official tweet about a new phishing website called: electrumcore dot org
Please always pay attention to which links you click on and in the best case always type the official URLs into the browser bar yourself

Thanks for the info, I read it also on the announcement on Electrum Twitter, I hope they have always updated this kind of warning to avoid user failing into scams. Usually, after being found, the scammer will change the domain into a phishing one to get a new target. We have to watch this IP being related to another phishing.




Has anyone known if electrum-web dot com is the official electrum? Because when I visit that site will direct me to Electrum's official Twitter and github. And I don't know if Electrum has telegram also (electrum_support), maybe this site is potentially phishing, but I am not sure about that.

[o_e_l_e_o]

Verifying the file signature is the best practice but pretty sure there are many who do not have any idea how PGP works and how to deal with Kleopatra or such type of software. So assuring someone on the official site is the first step of many security measurements in my opinion.

It's the first step, agreed, but it is entirely inadequate on its own. There are links on the Electrum download page to tutorials regarding how to verify your download, plus a quick search of this forum will find this excellent thread: [GUIDE] How to Safely Download and Verify Electrum [Guide].

Absolutely it's another step in the process, but we shouldn't be taking shortcuts when it comes to the security of our wallets.

Has anyone known if electrum-web dot com is the official electrum?

No, it isn't.

And I don't know if Electrum has telegram also (electrum_support), maybe this site is potentially phishing, but I am not sure about that.

Electrum does not have Telegram support. As with 99.9% of things on Telegram, this is a complete scam.

[Lucius]

And to use uBlock Origin extension on your browser. In my experience, changing your search engine into a more privacy oriented one could help as well in avoiding these phishing sites appearing on your browser.

Adblockers are useful because they are primarily blocking the ads that appear at the top of the search, which is the first protection line for those who do not pay attention to details. If you go to a phishing location stated in the OP with uBlock it will not have any difference, you will still be able to visit that site.

What can have a preventive effect is certainly to report phishing site to Google (it can be made directly from some browsers - a report of the deceptive site) or to a hosting company. The only problem with phishing is that such pages appear in large numbers, and that means when you stop one, at least five new ones pop up.

[khaled0111]

Bookmarking the official website which is Electrum.org then verifying whatever file you download from that website. Even if the website gets compromised, it's unlikely that the hacker's compromise the devs keys. Accessing the right website then verifying the authenticity of every file you download is more than enough to verify that you are good..

[BitcoinGirl.Club]

Verifying the file signature is the best practice but pretty sure there are many who do not have any idea how PGP works and how to deal with Kleopatra or such type of software. So assuring someone on the official site is the first step of many security measurements in my opinion.

It's the first step, agreed, but it is entirely inadequate on its own. There are links on the Electrum download page to tutorials regarding how to verify your download, plus a quick search of this forum will find this excellent thread: [GUIDE] How to Safely Download and Verify Electrum [Guide].

Absolutely it's another step in the process, but we shouldn't be taking shortcuts when it comes to the security of our wallets.

I wish if everyone was such aware. I lost counts how many times I read people lost their coins because of installing fake Electrum or updated it with a click of a button and the balance disappeared.

What can have a preventive effect is certainly to report phishing site to Google (it can be made directly from some browsers - a report of the deceptive site) or to a hosting company. The only problem with phishing is that such pages appear in large numbers, and that means when you stop one, at least five new ones pop up.

Reporting to Google is waste of time from my experience but it's a good practice. Reporting to the hosting company works better especially I found Namecheap always takes such reports seriously.

[o_e_l_e_o]

I lost counts how many times I read people lost their coins because of installing fake Electrum or updated it with a click of a button and the balance disappeared.

Absolutely, which is all the more reason we should be telling everyone to verify everything they download and never simply trust what they download because they think they are on the right URL.

I agree reporting to Google is a waste of time, since Google have shown consistently and repeatedly that they are happy to promote known and proven scams to the top of search results, as long as the scammer pays them. Google don't care whatsoever about their users' safety or security. As Lucius says, for ever site that is taken down (eventually!), five more will take its place. I would also recommend uBlock Origin, but alongside that, simply stop using Google. You can't fall victim to Google's promoted scams if you simply stop using Google.

[Lucius]

Reporting to Google is waste of time from my experience but it's a good practice. Reporting to the hosting company works better especially I found Namecheap always takes such reports seriously.

Unfortunately, I have to agree that this is true, although a few years ago, it worked well and in 2-3 days the reported site was blocked. I don't know what happened, but Google has obviously changed something in its policy towards phishing reports, or it just has too many reports, or they fired those who dealt with it.

On the other hand, I have never had success with reports to hosting companies, but I definitely think that they should do a lot more to combat phishing. Obviously, they don't care too much either, because it is important to charge for the service, and if someone reports abuse, they still profited with the fact that they no longer have to provide the service.

[BitcoinGirl.Club]

Unfortunately, I have to agree that this is true, although a few years ago, it worked well and in 2-3 days the reported site was blocked. I don't know what happened, but Google has obviously changed something in its policy towards phishing reports, or it just has too many reports, or they fired those who dealt with it.

On the other hand, I have never had success with reports to hosting companies, but I definitely think that they should do a lot more to combat phishing. Obviously, they don't care too much either, because it is important to charge for the service, and if someone reports abuse, they still profited with the fact that they no longer have to provide the service.

I succeeded several times reporting the domain and hosting provider especially with namecheap. They seemed to me very seriously handles the reporting. Google is just too big these days. We can speculate only but they know their real reasons.

[icynote_original]

in my opinion, very strange. why .org domains can be used for phishing?
for creating an .org or organization, you must use a clear identity, a clear person in charge. but here it is very strange because it is used for phishing.

[Pmalek]

And to use uBlock Origin extension on your browser.

I use both uBlock Origin and AdGuard and never have issues with fake sites popping up in browser results as ads. But my question is, won't the ad blocker only protect you from seeing the Google ads at the top of the search results? E.g., if you do a search on 'Electrum website', this 'electrumcore.org' phishing site could still be displayed among the results. Not at the top of the page if it's an add, but further down in the search results. I doubt your Ad blocker can protect you against that.

I just did as an experiment, and among the results I see electrum-web.com, which is a phishing site.

[FinneysTrueVision]

Has anyone known if electrum-web dot com is the official electrum? Because when I visit that site will direct me to Electrum's official Twitter and github. And I don't know if Electrum has telegram also (electrum_support), maybe this site is potentially phishing, but I am not sure about that.

A lot of phishing sites will add some legitimate links and will even copy the entire interface to try and disguise their scam site. Besides the fake telegram support another obvious sign that this is a phishing scam is that it is pretending to be a web wallet.

These types of sites are constantly popping up. I doesn't matter what browser or search engine you use, these malicious URLs still show up in search results. The safest way to avoid this kind of fraud is by authenticating the signature on your download using PGP software. Telling people to verify downloads might not be the most user friendly approach but if someone wants to be financially responsible they owe it themselves to take a few minutes to learn the basics of PGP.