Fake customer support webpages

[ovcijisir]

Just wanted to share my experience with fake customer support when I tried to find support when reconstructing legacy wallet for Celo wallet. The reason I tried to reach out for help is  because the wallet I was using was discontinued and I tried to find a way to find compatible wallet I could use seed phrase on

Other wallets for same altcoin had different derivation path so my seed words were useless unless I find somd other compatible wallet.

Immediately after writing my post I received few dm's and it seems they all acted independently, but they were following same procedure.

They sent me information in DM where they claimed that they opened support ticket for "customer support" on my behalf and they gave me link to external website.

They also added to give support ticket number to their customer support.

The link they gave me in DM lead to external webpages with customer support dedicated to scamming, so I guess that by having expense of running "customer support" webpage that their operation pays off. Also just the number of different websites dedicated to this scam tells us in how much danger unsuspecting newbie is.

Lesson that should be learned from my experience:
1. ALWAYS check the links before clicking them by hovering your mouse over them and checking complete URL.

2. Be suspicious of people who you don't know and that is your first contact with them but are too eager to help.

List of scam customer support websites that tried to rob me that way (some are not active anymore, but I added them for archival reasons):

Code:

https://quicksresolve.com/
https://archive.is/HoUZt

https://chain-decentralizefix.web.app/
https://archive.is/lUs9N

https://livechat.zenidesk.com/
https://archive.is/ihKjx

https://daajinc.com/
https://archive.is/BBzIx

https://livesupport.lingbk.online/
https://archive.is/8jKZP

[lovesmayfamilis]

I think in our age of AI, no payback is needed to create a fake support service or fake reviews. If earlier scammers used fake photos of representatives of their organizations, stealing information from people who were completely far from their fraud, today AI helps in literally everything, from support services, and a multifaceted one, to fake video communication. The conclusion today should be one: do not trust not only your ears but, unfortunately, also your eyes, and double-check everything that seems natural several times.

[Shishir99]

This is the most common scamming method. I assume you have used a Discord server to reach them, and those people sent you private messages and sent those links, right? This is common when you are Discord server of an exchange or wallet. These scammers always wait for people who will look for support, and they reach you pretty fast, as if they are the official support.

As you already know, the support never supposed to DM you first regardless your condition. They would ask you to create a ticket on the same server and someone will be there to help you. Private message = Red flag. Never chat with anyone in DM.

[SmartGold01]

My joy here is that you were clever enough to detects and senses a wrong move, like you knew on time that something was phishing so you easily detected it. You post made me to have that thinking that whenever there is an issue we should at least try as much as possible to not go easily accept those people that quickly ran to us to help us because these people are dedicated scammers who are just acting as an eye service to pretend as if they wanna help but dip down inside they really wanna milk us from our hand earned money..

[Zwei]

i had the same thing happen to me here on the forum a few months ago: https://bitcointalk.org/index.php?topic=5535453.0

they send those PMs to everyone on the forum and other platform who are looking for help with thier crypto, wallets, etc...
i'm not one to fall for something like this (i'm sure many others are the same), but the fact this group of scammers have been doing this possibly for months now shows they are quite successful at scamming people with this method, else they would not be wasting their time.

Code:

https://chain-decentralizefix.web.app/
https://archive.is/lUs9N

https://livesupport.lingbk.online/
https://archive.is/8jKZP

i have reported both of the sites that are still live.

the first one to google, since it's hosted on firebase: https://safebrowsing.google.com/safebrowsing/report_phish/
and the second to namecheap, as the domain is registered there: abuse@namecheap.com

[khaled0111]

Thank you for the warning OP, and as a rule of thumb, you should always be careful and never trust personal messages from random people.
If you have a problem, avoid asking about it on public platforms like telegram discord.. always try to reach out to customer support via their official channels.

In your case, since the wallet website seems to be down, you should have used Google to search for the information you are looking for or just asked here and I'm pretty sure many members would have helped you.

In case you didn’t figure it out yourself untill now,. I did a quick search and found that the derivation path Celo wallet used to use is: m/44'/52752'/0'/0
https://forum.celo.org/t/deprecating-the-celo-derivation-path/9229
Hope this helps!

[ovcijisir]

I think in our age of AI, no payback is needed to create a fake support service or fake reviews. If earlier scammers used fake photos of representatives of their organizations, stealing information from people who were completely far from their fraud, today AI helps in literally everything, from support services, and a multifaceted one, to fake video communication. The conclusion today should be one: do not trust not only your ears but, unfortunately, also your eyes, and double-check everything that seems natural several times.

This is sad truth, that AI will be used more and more for such things. Before we could detect scammers easier because they used bad grammar and made unprofessional looking messages and e-mails. Now it is all available at the click of the button, for bad and for good. Like you said, we can not trust our senses now, but think logically before every action. I am most afraid for unexperienced members who don't know what to expect and could fall to scams easily.

This is the most common scamming method. I assume you have used a Discord server to reach them, and those people sent you private messages and sent those links, right? This is common when you are Discord server of an exchange or wallet. These scammers always wait for people who will look for support, and they reach you pretty fast, as if they are the official support.
~

It was actually on official Celo forum, and I was very surprised that there are so many scammers lurking there. I understand these things can happen in Discord and Telegram but it was their official forum, I was surprised that scamming it at so big scale.

~

Code:

https://chain-decentralizefix.web.app/
https://archive.is/lUs9N

https://livesupport.lingbk.online/
https://archive.is/8jKZP

i have reported both of the sites that are still live.

the first one to google, since it's hosted on firebase: https://safebrowsing.google.com/safebrowsing/report_phish/
and the second to namecheap, as the domain is registered there: abuse@namecheap.com

Thank you for reporting them Zwei! The more report we send, the sooner they will close and less people will get scammed

Thank you for the warning OP, and as a rule of thumb, you should always be careful and never trust personal messages from random people.
If you have a problem, avoid asking about it on public platforms like telegram discord.. always try to reach out to customer support via their official channels.

In your case, since the wallet website seems to be down, you should have used Google to search for the information you are looking for or just asked here and I'm pretty sure many members would have helped you.

In case you didn’t figure it out yourself untill now,. I did a quick search and found that the derivation path Celo wallet used to use is: m/44'/52752'/0'/0
https://forum.celo.org/t/deprecating-the-celo-derivation-path/9229
Hope this helps!

Thank you for advice and article! In the end I found the derivation path, but have not yet recovered the wallet. I yet have to install Celocli software and recover it from there. I'll probably do it in next few weeks when I find more time. I'm not in hurry to sell it yet considering the current price.

[albon]

It was actually on official Celo forum, and I was very surprised that there are so many scammers lurking there. I understand these things can happen in Discord and Telegram but it was their official forum, I was surprised that scamming it at so big scale.

Any forum or discussion forum like the official Celo forum, Reddit, Quora or this forum, you will find many scammers who may contact you once they see that you have asked a question, are in need of help or once you reveal what cryptocurrencies you hold or that you have lost or had your coins stolen.. That’s why it was good that you stayed alert when you came across those fake webpages that were sent to you.

There are also scammers who may share a real-looking link but embed a hidden fake link inside it. To avoid this, you can right-click on the link, select copy link address, and verify it before opening.

I hope your topic serves as a lesson to beginners in the forum,, not to trust strangers or anyone who messages them first, and to be cautious before using any wallet or opening any link.

[ovcijisir]

Just a little update, I have received one more scamming message to contact fake "customer support" on following website:

Code:

https://websync-validation.vercel.app/
https://archive.is/eGqiM

[khaled0111]

^^
It looks like Vercel is a kind of a free hosting service. So, those thieves are too cheap that they don’t even want to invest few bucks on buying a proper domain and hosting plan.

I guess you will keep receiving such phishing messages as long as your post on that forum is up and visible for everyone. If you already got the help you were looking for, then it’s better to delete that post or lock it, if that’s possible.
If you are receiving those messages from members of the said forum, you can also try reporting them. This won’t stop them but it will, at least, slow them down a bit.

[Zwei]

^^
It looks like Vercel is a kind of a free hosting service. So, those thieves are too cheap that they don’t even want to invest few bucks on buying a proper domain and hosting plan.

that, but they also use those hosting services like vercel.app, pages.dev, web.app, to not get blocked by filters, as those domains/services have high trust rating compared to a new domain.

I guess you will keep receiving such phishing messages as long as your post on that forum is up and visible for everyone. If you already got the help you were looking for, then it’s better to delete that post or lock it, if that’s possible.

or he can keep the post up as bait, so he can post those websites here so we can report them, but it's up to him if he want to do that.