GuildOfGuardians[.]net : Yet Another Imposter

Caution: Before you connect your Metamask wallet to a site, check three times it's an official site for the project from multiple sources.

Came across this site today, hxxps://guildofguardians[.]net.  This is yet another fake website that attempts to impersonate Guild of Guardians.

This is a particularly scary site as it offers the ability to connect your wallet to the site.  It's also been around since September 2021 according to domaintools.com.


The branding is very similar to the actual Guild of Guardians site, and a lot of imposter sites will grab assets from the real page.

Notice the buy heroes, buy pets and energy and buy guilds buttons all look very similar to the actual site.  However, some of the red flags include:

  • Not in the Official Links channel on the Guild of Guardians discord
  • The price for GOG is way off (1 GOG is currently worth more then $0.1)
  • It mentions VR/AR which isn't on the actual GoG roadmap
  • When you refresh the page the timer resets back to 13 hours... there's always 13 hours left in the sale!
  • The offer is too good to be true
This is a good example of a scam site... well bad example, I mean nothing really good about this stuff, but you get what I mean.  When you see someone offering to sell a token and the price seems way to low, it probably is.  Cryptocurrency prices are certainly volatile, but if you see a price that seems off don't hesitate to double check at a couple of reliable sites (and check more then one):

https://coinmarketcap.com
https://coindesk.com
https://coinbase.com

The site actually links back to some of the official pages, like the whitepaper link in the top left corner links to the actual whitepaper.  The twitter social media link also takes you to the official Guild of Guardians Twitter account. This might trick a visitor into thinking the site has some credibility.  But if you're reading this post, then you already know this is a ploy.

The hero purchase section also looks very convincing, and offers bonus GoG, so much that it's way too good to be true:



If you were to click on the "Buy Now" button you'd be prompted to connect your Metamask Wallet.  Never, ever, ever test this sort of thing with your actual wallet.

This site is an example of how tricky an imposter site can be.

Stay safe out there.  Don't connect you Metamask wallet to any site that you haven't verified to be official.  If you come across any other scams don't hesitate to @gogscamtrakcer on Twitter or email report@gogscamtracker.com.

Going to see if I can work out whether I can find any of the scammer contracts or wallets associated with this particular site and if I do I'll be sure to post some more.

Comments

Post a Comment

Popular posts from this blog

NameSilo Abuse Reporting

Image
On Sunday I sent a message to NameSilo (abuse@namesilo.com) regarding the following token scam websites: guildofguardianes[.]com guildofguardians[.]net guildofguardian[.]net guildofguardians[.]cc It's hard to predict the response for any given domain registrar.  Some are really responsive, but in my experience if you want to get something done quickly you need some kind of pre-existing relationship with the registrar in question.  This is where companies like Phishlabs (https://www.phishlabs.com/) shine with their brand protection services as they automate the process of requesting takedowns for their clients and invest in maintaining strong relationships with registrars. As an independent researcher, my success with getting sites taken down varies. In this case I received an automated response directing me to their "Report Phishing Form" hosted at https://new.namesilo.com/phishing_report. I can only imagine the volume of phishing reports this registrar gets, and there
Read more

More Sites Taken Down

 Last week I received responses from NameSilo confirming they took action on the following domains: zerions[.]info zerions[.]com guildofguardians[.]org guildsofguardians[.]me guildofguardians[.]top I'm very impressed with NameSilo's response time, they've been very cooperative.  If anyone from NameSilo happens to read this article, thank you so much! I still have several domains to work my way through hosted on the same servers.  It's easy to drown in the amount of scams around crypto, so I try to focus on Guild of Guardians related scams, but it's difficult to leave the others hanging.  I'm hoping to get through reporting the rest of the domains soon. A bit of a short update, but it's been a bit of a crazy week last week.  Will write up a more comprehensive update this week. Stay safe out there, and if you see anything suspicious you can always reach me @gogscamtracker on Twitter or email report@gogscamtracker.com.
Read more

Down MetaMask Impersonation Rabbit Hole

Image
It's Friday night.  I should be doing something else.  I have a VR headset literally two feet away from me collecting dust, and what I am I doing?  I'm scouring the internet for more sites that have implemented a specific MetaMask impersonation technique. I created a short video demonstrating the technique, and if you're curious you can check it out here: https://youtu.be/OJu9HlJ2wsc At first it was just a few Guild of Guardians sites that I found and managed to get taken down, but shortly after I decided to leverage dnstwist to find some additional look-a-like domains, and after adding the tld swap option I uncovered even more. I noticed a pattern though, two IP addresses kept coming up in connection with this particular MetaMask impersonation: 5.61.58.93 and  45.136.50.34 If you want to know what all is hosted on a particular server you can leverage tools like VirusTotal.  In some cases you'll come across IP addresses used by shared hosting providers, in other words y
Read more