Keep your Bitcoin Fund safe, Be wary, Be Safe before Clicking

[lionheart78]

We have seen lots of news on the internet about how an individual lost his Bitcoin and other cryptocurrency due to phishing and hacking events.  Here is one of the articles that states phishing as the culprit in how a person loses his Bitcoin.

Ledger wallet user reports 10 BTC loss — Community blames phishing

Although clicking links does not automatically infect our system with malware or does not automatically phish our information, the next step after clicking the malicious link is the culprit since we ought to supply the information required for log-ins, and other authorities that we might unknowingly be granting the culprit due to phishing sites.  So I believe it is best to solve the possible problem before it even occur.

With this, I wanted to share some information that might be helpful in identifying if the link is malicious or safe in order to minimize the chance of losing our Bitcoin fund from any possible malicious or phishing attempt.  This information can be seen in this site : 21 Tips to Check If a Link Is Safe Before You Click

And among those lists, I wanted to emphasize this one:

Watch Out for Sneaky “Look-alike” Links

This scheme uses a homograph attack where the link looks exactly the same as the original one but they are actually entirely different.  See the article example:



We can't see the difference do we?

But well, they are different since one is in full Latin while the other one uses Cyrillic on "a" or "app" and Latin the rest of the letter.  Although these two seem to look like the same link, they are different.

Although most modern browsers flag this kind of attack nowadays, it does not hurt if we have the knowledge about this homographic attack and how we can address this issue.  Besides scammers and hackers have ways to bypass these blocking/flagging methods of browsers.

If in doubt we can check the composition of the domain by copy-pasting the link and check it on the text editor to see whether there is trickery or not. 
We can also use the following tools:
https://www.punycoder.com/
https://unicode-explorer.com/

Here is an article that shows how homograph attack mimic blockchain.com to scam cryptocurrency users. : https://umbrella.cisco.com/blog/keeping-your-crypto-safe-as-cryptocurrency-phishing-attacks-soar

How attackers target Blockchain
Malicious actors which target Blockchain.com still utilize homograph attacks. These attacks are based on standards of the modern internet that allow the creation (and display in web browsers) of URLs with characters from various language sets (with non-ASCII letters). In the example below the real URL is login.xn--blockchin-c3a[.]com, but when rendered by the browser looks relatively legitimate. The issue is worse on mobile devices where the URL is not always displayed in full.


These fraudulent websites are distributed through a variety of methods including email, SMS text messages, social media, and search-engine advertisements. On average, such campaigns last for three to seven days and affect 20 to 40 users daily.

It is also reported that homographic attack is also used to phish out information by Attacking Signal, Telegram, and Tor Browser with homographs^[1].  Through the years homograph attacks have been used by many scammers, hackers, and spammers to phish out information from unsuspecting victims.  And the best way to combat this kind of spoofing activity is to have full knowledge of how it works, the strategy, and the scheme of how it is laid out.  This way, we will know that it is an attack just by one glance at the link.

So I guess it does not hurt to have a glance at the following site on how to detect and avoid homograph attacks:

Homograph attack: What is it and how to avoid it
Homograph attacks: How hackers exploit look-alike domains
How to deal with homograph attacks


[1] https://portswigger.net/daily-swig/lookalike-domain-phishing-attacks-threaten-signal-and-telegram-users

[BlackBoss_]

With this, I wanted to share some information that might be helpful in identifying if the link is malicious or safe in order to minimize the chance of losing our Bitcoin fund from any possible malicious or phishing attempt.  This information can be seen in this site : 21 Tips to Check If a Link Is Safe Before You Click

A safest practice is don't check link, don't click on link from strangers. You don't have to mind about links sent to you by strangers and don't need to waste your time for checking whether those links are safe.

If your checking skill is bad, you can have false result and believe that a link is safe.

Punycode Phishing attacks - how to stay safe - Spoofed URLs and fake websites!.

[Oshio-man]

You are right op, there is a lot of things that happened for people to lose their bitcoin funds, I heard that cat eat someone seeds phrase that cause the person to lose his bitcoin funds, he have saved for many years. I think I learned something new from this your information, but scammers keep using different tactics or strategies to hack people wallet to have way into their bitcoin funds without their permission.

[EluguHcman]

With this, I wanted to share some information that might be helpful in identifying if the link is malicious or safe in order to minimize the chance of losing our Bitcoin fund from any possible malicious or phishing attempt.  This information can be seen in this site : 21 Tips to Check If a Link Is Safe Before You Click

A safest practice is don't check link, don't click on link from strangers. You don't have to mind about links sent to you by strangers and don't need to waste your time for checking whether those links are safe.

If your checking skill is bad, you can have false result and believe that a link is safe.

So I was just imagining the risky effect it could be of someone learning that a link is phishing and you still attempts to click on it just to check it out.
So you want to fall victim before believing such scam exist? Just wondering how people steps on toes.

The techniques of identifying phishing links or how you can get scammed could be challenging to lot of persons and as the case maybe, hackers and scammers are always smarter with different unknown methods to us (targets).
Sometimes it does not really matter how you have equipped your device security also as the browsers, so the scammers malicious programs could be stronger than the anti scam software stored in that your device which could breach your cyber security.

So in accordance to what you have said, the best to minimize or stay free from your wallet compromise is just.... Don't trust unknown or suspicious source of informations and always verify before you steps on.

Keep suspicion that hackers is always there in the internet and behind you in your society with the plans of stealing your Bitcoin.
Conciousness is the best tool to escape getting your Bitcoin lost when you know it treasury reflections is very attentive to scammers.

[osasshem]

Any link that is sent from an untrusted sources is not to be checked or clicked on, no matter what it is. This I have observed that it is always those who are tasty of making huge sum of money with little to no effort that do fall into these problems.

As homographic forms of attacks are becoming more rampant in the internet, not just in the crypto industry, but even in betting and casino sites, with those annoying adverts that pops up on screens of mobile phones.

I would like to ask, is it that when creating the domain of a site, the fonts can be changed too or it is generated automatically by the hosting platforms? Cause, the little I know about hosting of websites, search for the domain name, and pay for it. 

[lovesmayfamilis]

Human curiosity brings many regrets and losses in financial matters. You should always be suspicious and ask yourself why you are being shown this or that link. Everything related to finances should be separated from regular surfing on the Internet. The OP is right; even if you get to a phishing site, when you do not know about it, you need to think about whether this is the source where you can trust entering your data. In addition, having a high-quality antivirus and a secure browser with protection from phishing and switching only to secure HTTPS protocols should be the rule where there is a financial interest.

[BlackBoss_]

So I was just imagining the risky effect it could be of someone learning that a link is phishing and you still attempts to click on it just to check it out.
So you want to fall victim before believing such scam exist? Just wondering how people steps on toes.

Your reply has nothing related to what I post. I posted oppositely with what you argued perhaps against me here.

I said like, you don't need to check any link is a phishing link or not, just ignore links sent to you by strangers. Then in your post, you argued me with different meaning. Perhaps you misunderstood my post or you did not read my post carefully enough before typing yours.

If you are curious, and think that if you spend time for checking a link, it makes you safer, but are you sure that your checking skills are good enough to save you?

[EluguHcman]

So I was just imagining the risky effect it could be of someone learning that a link is phishing and you still attempts to click on it just to check it out.
So you want to fall victim before believing such scam exist? Just wondering how people steps on toes.

Your reply has nothing related to what I post. I posted oppositely with what you argued perhaps against me here.

I said like, you don't need to check any link is a phishing link or not, just ignore links sent to you by strangers. Then in your post, you argued me with different meaning. Perhaps you misunderstood my post or you did not read my post carefully enough before typing yours.

If you are curious, and think that if you spend time for checking a link, it makes you safer, but are you sure that your checking skills are good enough to save you?

You are probably the one misunderstanding me because I was only giving a backup to what you have said saying that... "Avoiding to click untrust links especially one from unknown is best safer" if it can be avoided and not even giving it a try like testing the water to verify if it was really that tainted as said.

Some people do actually dare to take risks of getting information verified first such as clicking on suspecious link and see it outcome before believing it is a deceptive link.

So on the interpretation, I was trying to tell how vulnerable it could be to grant access of your informations to scammers when you are not concious of malicious means of how scammers operates which best to say it is better not to step on unknown source especially links instead of trying to check it out if it is really a scam link regarded to OPs statement on the quote below.

 

If in doubt we can check the composition of the domain by copy-pasting the link and check it on the text editor to see whether there is trickery or not. 
We can also use the following tools:
https://www.punycoder.com/
https://unicode-explorer.com/

In further explanation, it is not necessary or it is highily risky in attempting to check out if a link is phishing even after being warned about it just as OP stated.

Some people believing they have secured their device cyber security, it may urge them to still click on the warned malicious link without knowing the strength of the scammers software could defeat their own device security program capacity which could lead to security breach.

So I was on the same page with you commending that it is better we don't even try to check/click the untrusted link out before believing it could hurt us.
And in all, we stand a safer side if the links (unknown) is just being ignored.

[CryptSafe]

This aspect of OPs findings is very accurate and to be frank I have observed this as well and I had to ask question to the person who told me about the website to verify before I proceed with my transactions. And she confirmed the site to be real because when I type the link I was seeing similar websites with virtually almost the same words and it was a bit confusing so I had to call to confirm and this happened last year. I just needed to do it because any mistake my funds are gone so that prompted me to call her for confirmation.

Sometimes we just have to calm down and swallow our pride irrespective of our years of experience in the industry to make enquiries. I have also observed that this aspect of engagements has caused many people alot. They feel as they are vast and experienced in the industry they do not need bother to call someone they feel is below them in the industry meanwhile that person is in the position to confirm the authenticity of the website or links that seems confusing them for clarity. They ignored and fall into scam because of their ignorance. People should just learn to make enquiries so as to be on the safe side when conducting transactions online visa website.

[sunsilk]

To be honest, I cannot figure out the difference between the examples given about the apple. This is how clever hackers are nowadays. With simple bookmarking of the usual websites we use for logging in our accounts that has cryptos in it, that will save us from that trouble.

How attackers target Blockchain
These fraudulent websites are distributed through a variety of methods including email, SMS text messages, social media, and search-engine advertisements. On average, such campaigns last for three to seven days and affect 20 to 40 users daily.

No one is going to skip these attacks through these channels. That is a real thing that we have to encounter everyday and all we can do is to avoid and ignore those texts and emails.

Even some calls I guess if you're too curious who's calling you, you'll call them back and boom that's the trap will be set for you. Stay safe everyone, hackers don't sleep.

[knowngunman]

A safest practice is don't check link, don't click on link from strangers. You don't have to mind about links sent to you by strangers and don't need to waste your time for checking whether those links are safe.

If your checking skill is bad, you can have false result and believe that a link is safe.

Punycode Phishing attacks - how to stay safe - Spoofed URLs and fake websites!.

And even your trusted pals can be hacked at times and malicious or phishing link can be shared by hackers through their platforms. I would rather say don't ever click on links you do not request for. As far as you did not request for a link before they're being shared to you, don't click on it whether they're coming from a stranger or known person.

I'm not an expert when it comes to tech but with my little knowledge, I do try the best I can to verify links before interacting with them. Moreover, it's unsafe sharing sensitive information with unknown site especially the crypto related ones. The more we try to be safe from this hackers, the more they're improving their strategies. Very unfortunate!

[promise444c5]

I would rather say don't ever click on links you do not request for. As far as you did not request for a link before they're being shared to you, don't click on it whether they're coming from a stranger or known person

These links can be urgent and demanding sometimes, but I also think it depends on how you get them.

If it's through an email, it's better to check if it's coming from the right source before taking any action. And yes, look-alike links are very common, also embedded within a button.

As an SMS, ignore it, especially if it's coming from someone whose number you don't have.

You will likely get lots of these links online too , social media, websites, and a lot more. If you don't know what it works for or can't verify it, then let it be. Otherwise, you can't do without clicking/viewing links entirely.

[BIT-BENDER]

You are right op, there is a lot of things that happened for people to lose their bitcoin funds, I heard that cat eat someone seeds phrase that cause the person to lose his bitcoin funds, he have saved for many years. I think I learned something new from this your information, but scammers keep using different tactics or strategies to hack people wallet to have way into their bitcoin funds without their permission.

Some people may not believe the cat eating seed phrase to be true but for sure it can actually happen. But when dealing with your seed phrase you need to know that you should be very serious about securing it.
I recommend that you probably have your seed phrase saved in multiple places and out of reach of pet, pest and theft.
Also their are people who save their seed phrase in their email. This is the worse mistake you can make and there is no excuse for it.

[Aanuoluwatofunmi]

The amount of money involved in this is much to lose just like that, everyone of us have to understand that we must have our wallet in a non custodial wallet, not only that, we should ensure that we don't connect our device used for wallet to the Internet, once we are not found under any of these, our chances to fall under such attempt for attack will be minimal, because we are not exposing ourselves online and can't receive any link or physhing attempt and links with the aim of scam or hack.

[Felicity_Tide]

The two URLs in that image were what I saw first, and I literally couldn't figure out the difference until I read the entire thread. I’ve seen some phishing related scams with slight differences in the URL names, but today happens to be my first time coming across homograph related scams. In as much as avoiding certain links is always advisable, what are the chances we can avoid almost every link we see (both genuine and fake), considering the fact that we all use the internet every single day.

I think the bottom line should be to separate personal funds entirely from the devices we use frequently to access the internet. Because, I really don’t know how someone can spot the difference when the URL are literally alike just like the one in the OP.

[Sim_card]

I feel that the best way to stay safe from phishing link is not to click on random links but avoid them. It's also good that you don't involve yourself in a lot of activities on the internet that will make you more vulnerable to phishing links. Like others said, if you can have two devices, one strictly for your crypto assest and the other for whatever you want to do on the internet.

[batang_bitcoin]

I feel that the best way to stay safe from phishing link is not to click on random links but avoid them. It's also good that you don't involve yourself in a lot of activities on the internet that will make you more vulnerable to phishing links. Like others said, if you can have two devices, one strictly for your crypto assest and the other for whatever you want to do on the internet.

While we can avoid them because of awareness and we don't have negligence to our actions if it's avoidance of these phishing links. We have ways to determine if they should be avoided and completely ignore them. Those that have a lot of things to do in the internet, they need to be careful. If they're dwelling in multiple files and keeps on downloading them from unknown sources, they're the most vulnerable and also the newbies that does it and chooses the free source from uncommon websites. Do not click, do not download and be aware.

[leonair]

You are right op, there is a lot of things that happened for people to lose their bitcoin funds, I heard that cat eat someone seeds phrase that cause the person to lose his bitcoin funds, he have saved for many years. I think I learned something new from this your information, but scammers keep using different tactics or strategies to hack people wallet to have way into their bitcoin funds without their permission.

Hackers have become very smart now and are implementing many subtle plans which are very difficult for a common man to understand. They create links and APIs in such a way that most people are forced to click. Because it is very difficult to understand the difference between real and fake. However, if you are careful, you can protect yourself from everything. Because no matter how carefully the crime is done, there will be clues. op has created a very good topic that everyone should know.

[Mrbluntzy]

This is real, crypto holders ought to be Meticulous in any activity they are doing online because their are so many scam methods that scammers are using now. Apart from the clicking on fake website link, some people are also getting hacked in ways I can not tell. My friend who recently created and verified her Bybit exchange account got logged out and she didn't know why but when she tried to log into the the account, her phone number has been changed and the account was placed on google authenticator, she can't log into the account since last week.

[btcltcdigger]

Ah, the old story of people falling for phishing, then blaming the hardware wallet issuer. I've heard it happen many times, but at the end of the day, it's user error, plain and simple.
And yes, scammers are crafty, and smarter than ever. Never trust the google results before thoroughly checking them, as ads usually lead to phishing sites