How the scam operates.
Situs ini tampil sebagai antarmuka dompet Ethereum self-custody yang sah, menyasar pemegang Ether dan token ERC-20. Domainnya menggunakan pengodean Punycode (ditandai dengan awalan xn--) untuk menyisipkan karakter Unicode non-ASCII yang, ketika ditampilkan di bilah alamat peramban, menghasilkan URL yang secara visual tidak dapat dibedakan dari layanan dompet yang sudah dikenal luas. Pengguna tiba dengan keyakinan bahwa mereka telah mencapai tujuan yang tepercaya.
Mekanisme operasionalnya adalah serangan homograf IDN: karakter Unicode yang secara visual menyerupai huruf ASCII pada nama layanan yang sudah dikenal disisipkan ke dalam domain pada tingkat pengodean. Korban yang tiba melalui tautan phishing, hasil pencarian yang dimanipulasi, atau kesalahan ketik yang nyaris serupa menemukan antarmuka yang meniru perangkat dompet yang sah. Situs tersebut meminta frasa benih (seed phrase), kunci privat, atau berkas keystore dengan dalih membuka kunci dompet; kredensial tersebut diteruskan kepada operator begitu dikirimkan, memberikan kendali penuh atas setiap alamat terkait.
Pembobolan biasanya berlangsung tanpa disadari. Situs mungkin menyimulasikan status pemuatan singkat sebelum menjadi kosong atau menampilkan kesalahan; tidak ada sinyal eksplisit mengenai pencurian yang ditunjukkan. Korban umumnya baru menyadari kerugian beberapa jam atau hari kemudian, ketika dana ditemukan telah disapu ke alamat yang tidak dikenal. Pada tahap itu, aset biasanya telah dipindahkan melalui transfer berlapis yang dimaksudkan untuk mempersulit pelacakan, dan peluang untuk intervensi on-chain telah tertutup.
Red flags we documented.
- 01IDN Homograph Domain ConstructionThe xn-- prefix identifies this as an Internationalized Domain Name using Punycode to embed non-ASCII characters that produce a visual clone of a legitimate service URL. This technique has no genuine application in consumer financial services; its documented use in this context is credential phishing.
- 02CryptoScamDB Blacklist InclusionThe domain is recorded on the CryptoScamDB community blacklist, a reference used by wallet developers, browser security extensions, and anti-phishing infrastructure. Independent third-party identification of this kind reflects active recognition of the domain as harmful.
- 03Credential Solicitation Through a Web InterfaceLegitimate self-custody wallet tools do not accept seed phrases or private keys through a browser form connected to a remote server. Any platform requesting these credentials via a web interface is operating contrary to foundational cryptographic security practice.
- 04Complete Operator AnonymityNo company registration, named personnel, regulatory licence, or auditable operational record has been documented for this site. Structural anonymity of this kind is a deliberate feature of phishing infrastructure, not an administrative oversight.
- 05A Pattern That Defeats Standard Safety PrecautionsUnlike phishing that relies on social engineering alone, an IDN homograph operation defeats a specific precaution: verifying the URL bar. Victims who follow standard safety guidance and check the domain before entering credentials may still be deceived, as the threat operates at the character-encoding level rather than the content level.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.