Bitcoin Forum
September 21, 2019, 02:30:41 PM *
News: If you like a topic and you see an orange "bump" link, click it. More info.
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: Blockchain impersonator scamming people!  (Read 2083 times)
bitbaby
Hero Member
*****
Offline Offline

Activity: 812
Merit: 1000



View Profile WWW
June 01, 2014, 08:07:12 AM
Last edit: June 01, 2014, 08:58:38 AM by bitbaby
 #1

http://blockchaln.info.gwyndara.com/ is a scamming site, when people search google for blockchain they see the first ad like this:



And the link is this: http://goo.gl/EMoA9Q and it forwards to http://blockchaln.info.gwyndara.com/  


Shut down the impersonating scammer's use of adwords:

Go to https://support.google.com/adwords/troubleshooter/4578507?rd=1

1. Choose "This is violating other AdWords Policies". Enter your email.

2. Choose 'Misleading Advertiser Claims'

3. For the next section 'What type of ad do you have feedback on?', choose 'Text/Image Ad'.

4. When you're asked to give the google ad url of the violation, give this url: http://www.google.com/aclk?sa=L&ai=CyFUqrt6KU6-5K4_NswfZyIDIAqKCyo0FgpeZo6sBgY3N8HMIABABUJKNve75_____wFgyb6DjNCk5A_IAQGpArAu9UoVILw-qgQeT9BoFtH12cwnufimjSpbDog3-ptlX8mxKPzV3gRLgAe648AwiAcBkAcC&sig=AOD64_1JHln038X6I7O9n5V0_RTZH7B3YA&rct=j&q=&ved=0CCkQ0Qw&adurl=http://goo.gl/EMoA9Q

5. Put the following in the "Please provide us with additional context for your submission" textbox:

Under the violation details textbox, put this:

http://blockchaln.info.gwyndara.com/ is a phishing site. When you google 'blockchain', a term used in the Bitcoin (a digital currency) ecosystem, that is a sponsored link. It appears as 'blockchain.info', which is a legitimate website. However, upon clicking on the link, you get sent to http://blockchaln.info.gwyndara.com, which impersonates https://blockchain.info/wallet/login and steals your password. Every once in awhile the subdomain is changed. For example, earlier it was http://http-blockchain-info.gwyndara.com, now it's http://blockchaln.info.gwyndara.com. They change the subdomain whenever one of the subdomains is reported for phishing, as http://http-blockchain-info.gwyndara.com currently is.


Also report this site here: www.google.com/safebrowsing/report_phish/?rd=1

--

1569076241
Hero Member
*
Offline Offline

Posts: 1569076241

View Profile Personal Message (Offline)

Ignore
1569076241
Reply with quote  #2

1569076241
Report to moderator
1569076241
Hero Member
*
Offline Offline

Posts: 1569076241

View Profile Personal Message (Offline)

Ignore
1569076241
Reply with quote  #2

1569076241
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
BitCoinDream
Legendary
*
Offline Offline

Activity: 1484
Merit: 1014

The revolution will be digital


View Profile
June 01, 2014, 08:47:34 AM
 #2

http://blockchaln.info.gwyndara.com/ is a scamming site, when people search google for blockchain they see the first ad like this:



And the link is this: http://goo.gl/EMoA9Q and it forwards to http://blockchaln.info.gwyndara.com/ 


Shut down the impersonating scammer's use of adwords:

Go to https://support.google.com/adwords/troubleshooter/4578507?rd=1

1. Enter your email

2. Choose 'Misleading Advertiser Claims'

3. For the next section 'What type of ad do you have feedback on?', choose 'Text/Image Ad'.

4. When you're asked to give the google ad url of the violation, give this url: http://www.google.com/aclk?sa=L&ai=CyFUqrt6KU6-5K4_NswfZyIDIAqKCyo0FgpeZo6sBgY3N8HMIABABUJKNve75_____wFgyb6DjNCk5A_IAQGpArAu9UoVILw-qgQeT9BoFtH12cwnufimjSpbDog3-ptlX8mxKPzV3gRLgAe648AwiAcBkAcC&sig=AOD64_1JHln038X6I7O9n5V0_RTZH7B3YA&rct=j&q=&ved=0CCkQ0Qw&adurl=http://goo.gl/EMoA9Q

5. Put the following in the "Please provide us with additional context for your submission" textbox:

Under the violation details textbox, put this:

http://blockchaln.info.gwyndara.com/ is a phishing site. When you google 'blockchain', a term used in the Bitcoin (a digital currency) ecosystem, that is a sponsored link. It appears as 'blockchain.info', which is a legitimate website. However, upon clicking on the link, you get sent to http://blockchaln.info.gwyndara.com, which impersonates https://blockchain.info/wallet/login and steals your password. Every once in awhile the subdomain is changed. For example, earlier it was http://http-blockchain-info.gwyndara.com, now it's http://blockchaln.info.gwyndara.com. They change the subdomain whenever one of the subdomains is reported for phishing, as http://http-blockchain-info.gwyndara.com currently is.



Nice catch... looks like gwyndara.com is an Irish Setters pet dog provider. Following is the domain owner's details from the domain history...

Martin, Quinlan  martyq@bigpond.com
    25 Caprella Street
    Heathridge, WA 6027
    AU
    +61.417996945


bitbaby
Hero Member
*****
Offline Offline

Activity: 812
Merit: 1000



View Profile WWW
June 01, 2014, 08:53:29 AM
 #3

Yes they are impersonating blockchain's wallet page, so I request all to report it to Google AdWords so they remove the Ad, And I also added the Google's report phishing site link to the top post: http://www.google.com/safebrowsing/report_phish/?rd=1

Report it there also, so when people open it they will receive a warning from Google.com

illymoka
Member
**
Offline Offline

Activity: 133
Merit: 10


View Profile
June 01, 2014, 08:55:40 AM
 #4

never used that shit and will never start. But I'm not wondered that some guyz are trying to earn on Bitcoin theme doing sites like that.
bitbaby
Hero Member
*****
Offline Offline

Activity: 812
Merit: 1000



View Profile WWW
June 01, 2014, 12:24:36 PM
 #5

After entering your email click "Misleading Advertiser Claims" and it will show :

Code:
What type of ad do you have feedback on?
Text/Image Ad
Video/Flash Ad

Chose "Text/Image Ad" and it will show a small input field just before the "Please provide us with additional context for your submission" enter the provided long url in the top post there.

Also report the website for phishing : http://www.google.com/safebrowsing/report_phish/?rd=1

roslinpl
Legendary
*
Offline Offline

Activity: 1988
Merit: 1168


https://cryptocoinsinfo.net


View Profile WWW
June 01, 2014, 12:32:08 PM
 #6

Reported.

Very good catch OP.

I hope not many of the people were cheated by this fake phishing site.

Tons of phishing attempts all around.
We must pay attention while surfing the net.

 
..
 
..
 
..
 
..
SIGNATURES
  █████████████████████████████████████████████████████████████████████████████  
███████████████████████████████████████████████████████████████████████████████████
██████                █████      █████                ███████                ██████
████                    ███      ███                    ███                    ████
████      ████████████  ███      ███      ████████████  ███      ████████████  ████
████      ████████████  ███      ███      ████████████  ███      ████████████  ████
████      ████████████  ███      ███      ████████████  ███      ████████████  ████
████      █████████████████      ███      █████████████████      ██████████████████
████  █████████████████████      ███  █████████████████████  ██████████████████████
████  █████████████████████      ███  ████              ███  ██████████████████████
████                  █████  ███████  ████              ███                  ██████
██████                  ███  ███████  ████      ██████  █████                  ████
██████████████████████  ███  ███████  ████████████████  █████████████████████  ████
██████████████████████  ███  ███████  ████████████████  █████████████████████  ████
██████████████████      ███  ███████  ████████████      █████████████████      ████
████  ████████████      ███  ███████  ████████████      ███  ████████████      ████
████  ████████████      ███  ███████  ████████████      ███  ████████████      ████
████  ████████████      ███  ███████   ███████████      ███  ████████████      ████
████                    ███  ███████                    ███                    ████
██████                █████  █████████                ███████                ██████
███████████████████████████████████████████████████████████████████████████████████
   █████████████████████████████████████████████████████████████████████████████  
|
██  ██ ██████ ███████ ██
 ██████   ██   ██ █ ██ ██
 ██  ██   ██   ██   ██ ████

████████████████████████████
████████████████████████████
████████████████████████████
████░░░░░░░░░░          ████
████░░░░░░░░░░          ████
▐███▌░░░░▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄███▌
▐████░░░░██████████████████▌
▐████░░░░░░░░░         ████▌
 ████░░░░░░░░░         ████
 ████▄▄▄▄▄▄▄▄▄▄▄▄▄    ▐████
 ▐████░░░░████████    ████▌
 ▐████░░░░████████    ████▌
 ▐████░░░░▀▀▀██▀▀▀    ████▌
  ████▌░░░░░░░       ▐████
  ██████▄▄░░░░    ▄▄██████
  ███████████▄▄███████████
  ▀▀▀██████████████████▀▀▀
        ▀▀▀▀▀██▀▀▀▀▀
BANNERS
 
..
 
..
 
..
 
..
bitbaby
Hero Member
*****
Offline Offline

Activity: 812
Merit: 1000



View Profile WWW
June 01, 2014, 12:40:59 PM
 #7

Thank you, hopefully with good many people reporting Google will remove the Ad or at-least it will start showing the warning when someone visits that site.

DeboraMeeks
Hero Member
*****
Offline Offline

Activity: 588
Merit: 500


View Profile
June 01, 2014, 12:57:01 PM
 #8

Reported, the site will be down in little to no time once its noticed.
Yeezus
Full Member
***
Offline Offline

Activity: 214
Merit: 100


View Profile
June 01, 2014, 12:59:37 PM
 #9

These phishing sites pop up quite frequently and I'm sure they'll only get more popular.

f12ej57kk
Newbie
*
Offline Offline

Activity: 40
Merit: 0


View Profile
June 01, 2014, 01:40:44 PM
 #10

is multibit more secure?
bryant.coleman
Legendary
*
Offline Offline

Activity: 2212
Merit: 1036


LiveCoin - is a modern stock exchange


View Profile
June 01, 2014, 01:46:17 PM
 #11

Is there a way to report these sites to the Kaspersky Internet Security URL Advisor or some other anti-Virus web browsing suite? I am afraid that already it is getting late... hundreds of people might have lost their coins up to now.

█████████▄           ▄█
▀██▄         ██
▀██▄    ▄▄ ██
▀███ ███ ██
█████████▄        ▀▀ ██
▀██▄      ▄▄ ██
▄█████████ ███ ██
▄██▀          ▀▀ ██
████
█▀            ▄▄ ██
▄██ ███ ██
▄██▀   ▀▀ ██
▄██▀        ██
███████████▀          ▀█




▄▄█
█████
█████
█████
█████
█████

█████

█████

█████


▄▄█
█████
█████
█████
█████
█████
█████
█████

█████

█████

█████
▄▄█
█████
█████
█████
█████
█████
█████
█████
█████
█████

█████

█████

█████
█▄           ▄█████████
██         ▄██▀
██ ▄▄    ▄██▀
██ ███ ███▀
██ ▀▀        ▄█████████
██ ▄▄      ▄██▀
██ ███ █████████▄
██ ▀▀          ▀██▄
██ ▄▄            ▀█████
██ ███ ██▄
██ ▀▀   ▀██▄
██        ▀██▄
█▀          ▀███████████
jc01480
Hero Member
*****
Offline Offline

Activity: 826
Merit: 500


Skype Me


View Profile
June 01, 2014, 02:21:59 PM
 #12

+1  Thank you for the warning.

byt411
Hero Member
*****
Offline Offline

Activity: 798
Merit: 1000


View Profile
June 01, 2014, 02:24:37 PM
 #13

Looks like it's marked as a phishing site and it's down already!
acs267
Hero Member
*****
Offline Offline

Activity: 672
Merit: 500



View Profile
June 01, 2014, 02:27:42 PM
 #14

There's so many of these. I actually clicked on one before, except it had somebodies IP for the subdomain. Ran off that site as if it was vermin. Most of them are reported, though.
kellzy
Newbie
*
Offline Offline

Activity: 52
Merit: 0


View Profile
June 01, 2014, 02:30:45 PM
 #15

It looks like put a bit more effort into this site than the normal phishing site.
Good job reporting it Smiley
I would hope most users look at the URL when they go to any sites. Ok ok it is possible to slip up at miss it.
jc01480
Hero Member
*****
Offline Offline

Activity: 826
Merit: 500


Skype Me


View Profile
June 01, 2014, 02:35:36 PM
 #16

Glad their response was swift.

bitbaby
Hero Member
*****
Offline Offline

Activity: 812
Merit: 1000



View Profile WWW
June 01, 2014, 06:11:59 PM
 #17

Thank you everyone who reported.  Smiley

The Ad is removed from the google search and It shows warning if someone visits the site.

So we won "for now" but they will be back with new plans so be aware. Cheesy

Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!