Update on Scam Sites

Back in January I posted about several scam websites and listed them on this page:

https://www.gogscamtracker.com/p/scam-address-list.html

The good news is that some of the sites have been since taken down, but others that have been up since January are still up.  One scam site in particular is pictured here:


It's hosted on several domains including one that was highlighted to me by someone from the community whose son was scammed.

  • guildofguardianes[.]com
  • guildofguardians[.]net
  • guildofguardian[.]net
  • guildofguardians[.]cc
I plan to do a much deeper dive on this site in particular and see if I can cooperate with the Guild of Guardians team to get these taken down (most domain registrars want the brand owner to initiate the takedown request), but first a short rant.

When people get scammed in crypto there is a bit of victim blaming that goes around, that the victim should have known better.  When it comes to DeFi, and you're working with experienced investors, and they get phished it's sad, but on the other hand, you can't help but feel like they should have known.  Now I've seen some very sophisticated phishes, and I know by experience even the best of us get caught sometimes and Crypto is very unforgiving.

Things are getting even more risky though. We have a whole generation of kids who are going to be growing up with Play-and-Earn gaming, and influencers shilling the latest crypto game.  These kids will have their own wallets so they can get airdrops and earn rewards, and some of them are going to have substantial holdings in crypto currency, or be using their parents wallets.  These are not seasoned investors or experienced fintech, but rather teens or younger who are going to be very suspectable to FOMO and phishing.  Guild of Guardians is exactly the kind of game my nephews would play, and they have zero cyber security training.  Which means, even though technically these games aren't meant for kids, they are going to become the victims as well.

I know it's cliché to say "What about the children!!" The traditional gaming industry already has a reputation for introducing kids very early to concepts like sex, violence, and profanity.  Even game monetization is nothing new with kids overspending on skins in games like Fortnite.  However, as already mentioned: Crypto is unforgiving.  When you make a mistake you can loose everything and that's a tough lesson to learn.

All that to say: If we want to bring millions of people into crypto gaming and play and earn, we have to get better at policing crypto scams.  The fact these same sites have been up since January is not an acceptable state of things.

Rant over... now back to trying to get these sites taken down.

Stay safe out there, and if you see anything suspicious you can always reach me @gogscamtracker on Twitter or email report@gogscamtracker.com.


Comments

Post a Comment

Popular posts from this blog

NameSilo Abuse Reporting

Image
On Sunday I sent a message to NameSilo (abuse@namesilo.com) regarding the following token scam websites: guildofguardianes[.]com guildofguardians[.]net guildofguardian[.]net guildofguardians[.]cc It's hard to predict the response for any given domain registrar.  Some are really responsive, but in my experience if you want to get something done quickly you need some kind of pre-existing relationship with the registrar in question.  This is where companies like Phishlabs (https://www.phishlabs.com/) shine with their brand protection services as they automate the process of requesting takedowns for their clients and invest in maintaining strong relationships with registrars. As an independent researcher, my success with getting sites taken down varies. In this case I received an automated response directing me to their "Report Phishing Form" hosted at https://new.namesilo.com/phishing_report. I can only imagine the volume of phishing reports this registrar gets, and there
Read more

More Sites Taken Down

 Last week I received responses from NameSilo confirming they took action on the following domains: zerions[.]info zerions[.]com guildofguardians[.]org guildsofguardians[.]me guildofguardians[.]top I'm very impressed with NameSilo's response time, they've been very cooperative.  If anyone from NameSilo happens to read this article, thank you so much! I still have several domains to work my way through hosted on the same servers.  It's easy to drown in the amount of scams around crypto, so I try to focus on Guild of Guardians related scams, but it's difficult to leave the others hanging.  I'm hoping to get through reporting the rest of the domains soon. A bit of a short update, but it's been a bit of a crazy week last week.  Will write up a more comprehensive update this week. Stay safe out there, and if you see anything suspicious you can always reach me @gogscamtracker on Twitter or email report@gogscamtracker.com.
Read more

Down MetaMask Impersonation Rabbit Hole

Image
It's Friday night.  I should be doing something else.  I have a VR headset literally two feet away from me collecting dust, and what I am I doing?  I'm scouring the internet for more sites that have implemented a specific MetaMask impersonation technique. I created a short video demonstrating the technique, and if you're curious you can check it out here: https://youtu.be/OJu9HlJ2wsc At first it was just a few Guild of Guardians sites that I found and managed to get taken down, but shortly after I decided to leverage dnstwist to find some additional look-a-like domains, and after adding the tld swap option I uncovered even more. I noticed a pattern though, two IP addresses kept coming up in connection with this particular MetaMask impersonation: 5.61.58.93 and  45.136.50.34 If you want to know what all is hosted on a particular server you can leverage tools like VirusTotal.  In some cases you'll come across IP addresses used by shared hosting providers, in other words y
Read more