How the scam operates.
etherwallet.shop menampilkan dirinya sebagai antarmuka dompet Ethereum yang sah, memanfaatkan nama domain yang sangat menyerupai layanan dompet kripto yang dikenal luas. Situs ini menarik pengguna yang sedang mencari layanan sah tersebut melalui kesalahan pengetikan URL, hasil pencarian yang menyesatkan, atau tautan yang dibagikan. Domain tingkat atas .shop merupakan kejanggalan yang langsung terlihat bagi sebuah layanan dompet yang sebenarnya, tetapi korban yang datang di bawah tekanan waktu mungkin tidak menyadari ketidaksesuaian tersebut.
Pola operasional yang konsisten dengan situs kategori ini adalah pemanenan kredensial. Pengunjung biasanya disuguhi antarmuka dompet yang meminta seed phrase, private key, atau kredensial login dengan dalih pemulihan akun atau impor dompet. Setelah dimasukkan, data tersebut dikirimkan kepada pelaku. Karena private key dan seed phrase Ethereum memberikan kendali penuh, tanpa syarat, dan tidak dapat dibatalkan atas dana terkait, satu pemanenan yang berhasil sudah cukup untuk menguras seluruh isi dompet.
Titik kegagalan biasanya terjadi seketika tetapi tidak kasat mata. Korban mungkin tidak menyadari adanya yang salah hingga mereka mendapati dana hilang dari dompet asli mereka. Pada saat itu, transaksi blockchain sudah tidak dapat dibatalkan dan pelaku biasanya telah meninggalkan domain tersebut. Pencantuman dalam daftar hitam CryptoScamDB mengonfirmasi bahwa situs ini telah diidentifikasi oleh komunitas intelijen ancaman, meskipun waktu pencantuman relatif terhadap suatu paparan individual tidak dapat ditentukan dari catatan yang tersedia.
Red flags we documented.
- 01Domain impersonation pattern targeting Ethereum usersThe domain closely mimics the name of a legitimate, widely used Ethereum wallet service. This is a textbook typosquat: close enough to attract misdirected traffic, different enough to be technically distinct. Legitimate wallet services do not register near-identical domains under commercial TLDs such as .shop.
- 02Commercial TLD inconsistent with wallet infrastructureThe .shop suffix has no functional relevance to a self-custody wallet service. Established Ethereum wallet providers use purpose-appropriate or branded domains. The choice of .shop suggests a registration optimised for disposability rather than operational credibility.
- 03CryptoScamDB blacklist entry confirms community-level flaggingThe domain appears in the CryptoScamDB blacklist, a community-maintained dataset used by browser extensions and security tools to warn users before they reach fraudulent sites. Inclusion requires identification by researchers or affected parties, indicating documented harmful activity.
- 04Seed phrase solicitation is an irreversible risk signalSites of this pattern typically request seed phrases or private keys under the guise of wallet import or recovery. No legitimate non-custodial wallet service requires a seed phrase to be entered on a web interface. Any platform making this request should be treated as hostile regardless of its visual presentation.
- 05No documented organisational presence or accountabilityThere are no aliases, registered entities, regulatory filings, or contact structures associated with this domain in available records. Operations lacking any verifiable organisational footprint are structurally designed to avoid accountability after funds are taken.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.