How the scam operates.
Situs ini menampilkan dirinya sebagai layanan dompet Ethereum yang sah, meminjam namanya langsung dari salah satu antarmuka dompet non-custodial yang paling dikenal di dunia mata uang kripto. Sinyal pencitraan merek dirancang untuk menenangkan pengguna yang terbiasa dengan produk asli, dengan harapan bahwa terminologi yang sudah dikenal akan menurunkan kewaspadaan mereka. Audiens sasarannya adalah para pemegang Ethereum yang mengelola dompet swakelola (self-custody), yang mungkin tiba melalui hasil pencarian, tautan media sosial, atau pesan phishing yang mengarah ke domain tersebut.
Operasi jenis ini umumnya berjalan dengan menampilkan antarmuka tiruan yang meminta private key atau seed phrase pengguna dengan dalih akses akun atau pemulihan. Setelah dimasukkan, operator memperoleh kendali yang tidak dapat dibatalkan atas dompet terkait. Karena transaksi Ethereum bersifat permanen dan tidak memerlukan otorisasi pihak ketiga, dana dapat dikuras seketika tanpa upaya hukum yang tersedia. Penyamaran ini diperkuat oleh nama domain itu sendiri, yang mereproduksi merek sasaran karakter demi karakter sebelum menambahkan akhiran top-level domain palsu.
Titik kegagalan menjadi nyata ketika pengguna mencoba mengakses dompetnya melalui layanan yang sah dan mendapati asetnya sudah tidak ada lagi. Pada tahap itu, situs phishing biasanya sudah tidak lagi merespons, dan tidak ada detail kontak operator yang tersedia. Karena kredensial dimasukkan secara sukarela dari sudut pandang jaringan, transaksi blockchain tidak menawarkan mekanisme pembalikan. Korban hanya memiliki bukti transfer di rantai (on-chain) tetapi tanpa sarana praktis untuk menelusuri alamat penerima tanpa investigasi spesialis.
Red flags we documented.
- 01Non-standard domain suffix signals an illegitimate operationThe '.active' top-level domain is not recognised by the Internet Assigned Numbers Authority, which maintains the authoritative registry of valid TLDs. A legitimate wallet service would not operate on a non-standard or fabricated domain extension. This alone is sufficient grounds for immediate suspicion.
- 02Name mimics a recognised Ethereum wallet platformThe domain reproduces the exact name of an established Ethereum wallet interface, differing only in the top-level domain. This pattern, known as brand impersonation or typosquatting, is consistently associated with credential-harvesting operations that rely on users recognising the name without inspecting the full domain.
- 03Listed on the CryptoScamDB blacklistThe domain appears in the CryptoScamDB blacklist, a community-maintained registry of confirmed fraudulent cryptocurrency addresses and domains. Inclusion indicates the site has been reported and verified as malicious by independent reviewers, placing it in confirmed rather than suspected territory.
- 04Credential-entry interface carries irreversible riskAny interface requesting a private key or seed phrase outside of a hardware wallet signing flow should be treated as a hostile surface. There is no legitimate operational reason for a web-based wallet interface to require this information. Entry of these credentials constitutes immediate and total loss of wallet control.
- 05No traceable operator or regulatory registrationNothing in the available record indicates this operation is registered with any financial authority, has a disclosed legal entity, or provides verifiable contact information. The absence of operator transparency is consistent with a disposable phishing asset rather than a legitimate service.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.