Fake Crypto Sites Followup

After a bit of digging I think I've found the batch of domains that were all registered on January 13th 2022 that are involved in the recent uptick in discord direct message scams.  These are all associated with the email address avgustaefremova1993@bk[.]ru.

Avoid these sites.  I'm hoping that by reporting them to Digital Ocean and reg[.]ru we can get them taken down quickly.

  • bin-core[.]com
  • camp-bit[.]com
  • camp-token[.]com
  • coin-bin[.]com
  • cron-bit[.]com
  • ext-bit[.]com
  • link-token[.]com
  • market-token[.]com
  • more-bit[.]com
  • set-bit[.]com
  • temp-bit[.]com
  • token-smart[.]com
  • token-next[.]com


There are an additional two domains that are registered using a different email address, but still associated with LLC Good using the identity Ovidiy Lapin, ovidiilapin2872@list[.]ru.

  • bit-investor[.]com
  • first-token[.]com
These were registered on January 8th 2022, so slightly earlier.  Time to pull the thread on Ovidiy.

Sure it feels a bit like whack-a-mole, but at least we can try to get these things knocked down as soon as they come up.


Comments

  1. UnknownMarch 13, 2022 at 1:15 PM

    This domain https://guildofguardianes.com/ is a scam and I'd like to report it. This website mimics the new "GuildofGuardians" metaverse and tricks people into buying characters for the game. Their site references links on the true site such as the whitepaper but essential you connect your digital wallet and then attempt to buy characters in the real game. But really, all your doing is sending money to a crypto wallet. Complete scam.
    The only reason I'm writing is that my teenage son was learning about the game and we ended up trying to buy not realizing the domain was wrong.
    Not sure if there is anything you can do or point me in the right direction in terms of (Law enforcement, etc) to file a complaint. Or how the Domain carrier handles fraud.
    Thanks for letting me know

    ReplyDelete
    Replies
    1. AspinDarkfireMay 1, 2022 at 2:38 PM

      I'm sorry it took me so long to see this comment. The blogger notifications weren't working. While I'm coming in way to late at this point, you can contact local law enforcement but typically they won't be able to do much. This same scam is running on several domains and I'm going to take a deeper dive on it to see what I can find.

      Delete

Post a Comment

Popular posts from this blog

NameSilo Abuse Reporting

Image
On Sunday I sent a message to NameSilo (abuse@namesilo.com) regarding the following token scam websites: guildofguardianes[.]com guildofguardians[.]net guildofguardian[.]net guildofguardians[.]cc It's hard to predict the response for any given domain registrar.  Some are really responsive, but in my experience if you want to get something done quickly you need some kind of pre-existing relationship with the registrar in question.  This is where companies like Phishlabs (https://www.phishlabs.com/) shine with their brand protection services as they automate the process of requesting takedowns for their clients and invest in maintaining strong relationships with registrars. As an independent researcher, my success with getting sites taken down varies. In this case I received an automated response directing me to their "Report Phishing Form" hosted at https://new.namesilo.com/phishing_report. I can only imagine the volume of phishing reports this registrar gets, and there
Read more

More Sites Taken Down

 Last week I received responses from NameSilo confirming they took action on the following domains: zerions[.]info zerions[.]com guildofguardians[.]org guildsofguardians[.]me guildofguardians[.]top I'm very impressed with NameSilo's response time, they've been very cooperative.  If anyone from NameSilo happens to read this article, thank you so much! I still have several domains to work my way through hosted on the same servers.  It's easy to drown in the amount of scams around crypto, so I try to focus on Guild of Guardians related scams, but it's difficult to leave the others hanging.  I'm hoping to get through reporting the rest of the domains soon. A bit of a short update, but it's been a bit of a crazy week last week.  Will write up a more comprehensive update this week. Stay safe out there, and if you see anything suspicious you can always reach me @gogscamtracker on Twitter or email report@gogscamtracker.com.
Read more

Down MetaMask Impersonation Rabbit Hole

Image
It's Friday night.  I should be doing something else.  I have a VR headset literally two feet away from me collecting dust, and what I am I doing?  I'm scouring the internet for more sites that have implemented a specific MetaMask impersonation technique. I created a short video demonstrating the technique, and if you're curious you can check it out here: https://youtu.be/OJu9HlJ2wsc At first it was just a few Guild of Guardians sites that I found and managed to get taken down, but shortly after I decided to leverage dnstwist to find some additional look-a-like domains, and after adding the tld swap option I uncovered even more. I noticed a pattern though, two IP addresses kept coming up in connection with this particular MetaMask impersonation: 5.61.58.93 and  45.136.50.34 If you want to know what all is hosted on a particular server you can leverage tools like VirusTotal.  In some cases you'll come across IP addresses used by shared hosting providers, in other words y
Read more