Contents:
Cryptocurrencies have been tremendously growing in popularity, which never fails to attract cybercriminals. While there are still legitimate transactions and investment opportunities in this fintech niche, there are also a lot of shady deals covered up by the anonymity of cryptocurrency, or even downright scams.
We have warned our readers about cyptocurrency scams before and advised them on how to safely invest in cryptocurrency from a security standpoint.
Today, our AI engines and the team of malware analysts and machine learning engineers who are actively working to continuously improve the PredictiveDNS™ capabilities powering our Heimdal™ Threat Prevention suite (for Endpoints and Networks) have uncovered a sophisticated new and vast phishing cryptocurrency scam campaign. We are revealing the entire scheme here of tracking these malicious hackers across multiple domains and websites.
How the Malicious Scammers Prepared the Ground for their Theft Campaign
The way this entire phishing campaign was planned out gives testimony to a remarkably organized group. The cybercriminals prepared the environment for their fraudulent campaign many months in advance with fake news websites about cryptocurrency.
This way, they could increase their ranking across search engines and be trusted as legit and trustworthy websites, as well as amass a readership of people interested in cryptocurrencies.
The registration addresses for all of these, while fake (rented out), span across UK, USA, Iceland, The Netherlands and more. The complexity of the campaign was carefully constructed to fly under the radar.
- https://primeinfos.com/ -> 2020-11-04 20:14:33 UTC
- https://inworldtalk.com/ -> 2021-01-26 13:13:26 UTC
- https://bitcocity.com/ -> 2020-11-04 20:14:33 UTC
- https://realtimebit.com/ -> 2021-01-26 13:13:28 UTC
- https://newspay.net/ -> 2020-11-04 20:14:38 UTC
The Purpose of the Phishing Cryptocurrency Scam Campaign
After laying the ground and building the trust of both search engines and readers, the cyber-criminals created several infected websites and shared them on fake news websites with articles like the following:
- https://primeinfos.com/news/2021-crypto-giveaway-with-bitupporfolio/
- https://bitcocity.com/bitupporfolio-bitcoin-has-become-a-good-long-term-investment/
- https://inworldtalk.com/tag/bitupporfolio-com/
Our AI algorithm was able to discover the following phishing domains from the fake cryptocurrency news websites:
• geowexbit.com -> 2021-03-08 19:11:37 UTC
• changebitc.com -> 2021-04-02 09:09:56 UTC
• bitctoo.com -> 2021-04-05 22:11:17 UTC
• geocryptonium.com -> 2021-05-03 23:00:59 UTC
• chillbtc.com -> 2021-04-09 12:49:24 UTC
• bitcmax.com -> 2021-04-16 17:28:16 UTC
• excoinbit.com -> 2021-04-01 15:01:10 UTC
• hugobitc.com -> 2021-04-30 11:43:43 UTC
• coinsray.com -> 2021-02-06 12:06:28 UTC
• bigbitc.com -> 2021-04-08 10:58:49 UT
• highbitc.com -> 2021-04-08 10:58:57 UTC
• frexcoin.com -> 2021-01-06 15:43:06 UTC
• bitelix.com -> 2021-03-05 17:06:13 UTC
• cryptonsky.com -> 2021-02-20 23:49:12 UTC
• bitcoinist.com -> 2011-04-25 13:53:36 UTC -> Updated Date: 2021-04-13T12:53:05Z
• bitacex.com -> 2021-03-09 10:31:44 UTC
• https://fast-bitcoin-doubler.com -> 2020-11-27 09:07:10 UTC
• https://wibexlive.com -> 2019-02-23 07:00:30 UTC
• https://waukeen.io -> 2018-09-21
• https://cryptoreet.com -> 2021-02-26 22:46:29 UTC
• https://traderydefi.com -> 2021-03-16 15:32:06 UTC
You can notice the complexity of the campaign judging by the variety and the age of these domains as well. We believe the hackers might have hijacked some formerly legitimate domains as well in order to include them in the campaign (considering how old the registry dates for some of these are – like 2011, for instance).
These malicious domains promise their readers that they will gain 8 ETH (Ethereum coin) if they can validate that the victim first sends them 0.3 ETH.
After completing the transaction, the money is lost and the data of the victim is likely stored for use in future cybercrime campaigns. The online Ethereum wallets of the hackers seem are empty right now, but this is probably part of a strategy to move funds and cash them in as soon as they receive them.
At the moment, none of these domains are reported elsewhere as being infected, which means that the cybercrime campaign hasn’t been discovered by other cybersecurity researchers so far.
With the internet as vast as it is, traditional cybersecurity research methods are of course only able to discover a small fraction of cybercrimes committed, and even fewer of these are discovered before they can do serious damage.
Without the help of our advanced PredictiveDNS™ AI engine within Heimdal™ Threat Prevention, it’s very likely that a long time would have passed until this new phishing cryptocurrency scam campaign was revealed.
Heimdal® DNS Security Solution
- Machine learning powered scans for all incoming online traffic;
- Stops data breaches before sensitive info can be exposed to the outside;
- Advanced DNS, HTTP and HTTPS filtering for all your endpoints;
- Protection against data leakage, APTs, ransomware and exploits;
—-
About Heimdal™ Security
Heimdal™ is a strongly emerging cybersecurity provider established in 2014 in Copenhagen, currently spanning offices across the world. With a spectacular year-over-year growth and an impressive ahead-of-the-curve approach to threatscape trends, Heimdal™ Security is the go-to solution for unified, intelligent cybersecurity made easy. In March 2020, Heimdal™ Security was acquired by Marlin Equity Partners, fueling its networks of growth and distribution even further.
yes write ftc or sarecoverygroup
Hey, you used to write great, but the last several posts have been kinda boring?K I miss your super writings. Past several posts are just a little bit out of track! come on!
Very scary all this. Most people like myself don’t know how to protect our transactions. We are all rushing to this crypto stuff not knowing the dangers.
I just downloaded Ethereum wallet and I am afraid to use after reading this article.
A new crypto is coming soon (December 1) . The name is 4JNET CRYPTO. Does anyone know something about it ?
please let me know if it is safe to buy.
Thanks good peoples.
they took 0.001 btc from me. can i get it back somehow? (i fell victim for bitctoo.com)
Very well written info!
Now, in case you were to choose a simple look at many of the exchanges around, you would need to concur that this is certainly the definition of What’s going on. Nonetheless, some should be still left puzzled as to what is Cryptocurrency Investing particularly.
I became a victim of bigbitc.com. They took my BTC. Is there any way to get this back? What else should I do now to stop them from harming others?
Thank you.