Cómo opera la estafa.
La operación se presenta como una interfaz funcional de wallet de Ethereum. Al registrar un dominio cuya codificación Punycode (xn--metherwallet-3ml.com) se ve casi idéntica a la de un servicio de wallet de Ethereum ampliamente utilizado cuando se muestra en ciertos navegadores, el operador posiciona el sitio para interceptar el tráfico de usuarios que, o bien escriben mal la dirección legítima, o bien siguen un enlace falsificado. La presentación visible imita el diseño esperado de una herramienta de wallet de autocustodia, dirigida a titulares de Ether y de tokens ERC-20.
La mecánica se apoya en un ataque homógrafo IDN, una técnica en la que uno o más caracteres Unicode reemplazan letras ASCII visualmente similares en un nombre de dominio. La barra de direcciones del navegador puede mostrar la forma decodificada del dominio, haciéndolo parecer genuino ante un usuario que no inspecciona la cadena Punycode subyacente. Las víctimas que proceden a acceder o recuperar una wallet a través de la interfaz suelen recibir la solicitud de introducir una frase semilla o una clave privada, que el operador captura en tiempo real antes de que la sesión concluya.
El momento del descubrimiento suele llegar cuando una víctima intenta transferir fondos y encuentra su saldo ya vaciado. Dado que el envío de la frase semilla es irreversible y otorga acceso total a una wallet, la recuperación de los activos en esa etapa depende por completo del rastreo forense a nivel de blockchain, y no de ninguna forma de reversión directa. Los operadores detrás de la infraestructura de dominios homógrafos suelen abandonar el dominio poco después de un ciclo de recolección, sin dejar ningún canal de atención al cliente, entidad registrada ni contraparte identificable a la que perseguir.
Banderas rojas que documentamos.
- 01Punycode prefix signals homograph intentThe xn-- prefix in the domain name is not a formatting quirk; it is the technical marker that this domain contains Unicode characters. Its presence in a wallet-adjacent domain name is a near-universal indicator of a lookalike or impersonation operation rather than a legitimate service.
- 02Listed on CryptoScamDB community blacklistThe domain appears in the CryptoScamDB blacklist, a widely-referenced dataset of confirmed malicious cryptocurrency addresses and URLs maintained through community contribution and ongoing verification. Inclusion is a hard signal, not a probabilistic one.
- 03Seed-phrase solicitation is an absolute loss signalAny web interface requesting a wallet seed phrase or private key operates outside all legitimate norms. No genuine non-custodial wallet service requires this for standard access. Submission to an unverified site constitutes an immediate, total, and irreversible transfer of wallet control to the operator.
- 04No legitimate wallet platform uses IDN homograph domainsEstablished cryptocurrency wallet services do not register their primary interfaces under internationalised domain names that incorporate Unicode lookalike characters. Such registrations have no plausible commercial purpose other than deception.
- 05Disposable infrastructure with no verifiable operatorHomograph-domain operations are low-cost to create and trivial to abandon. No corporate identifiers, regulatory licences, or verifiable operator details are associated with this domain, which is consistent with infrastructure designed for a single harvest cycle rather than a sustainable service.
Lo que puedes hacer ahora.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.