How the scam operates.
Operasi ini menampilkan diri sebagai antarmuka dompet Ethereum yang fungsional. Dengan mendaftarkan domain yang penyandian Punycode-nya (xn--metherwallet-3ml.com) tampil hampir identik secara visual dengan layanan dompet Ethereum yang banyak digunakan saat ditampilkan di peramban tertentu, operator memposisikan situs ini untuk menyadap lalu lintas dari pengguna yang salah mengetik alamat sah atau mengikuti tautan palsu. Tampilan permukaannya meniru tata letak yang diharapkan dari sebuah alat dompet swakelola, menyasar pemegang Ether dan token ERC-20.
Mekanismenya bersandar pada serangan homograf IDN, yaitu teknik yang menggantikan satu atau lebih karakter ASCII dengan karakter Unicode yang tampak serupa dalam sebuah nama domain. Bilah alamat peramban dapat menampilkan bentuk terdekode dari domain tersebut, sehingga terlihat asli bagi pengguna yang tidak memeriksa untaian Punycode yang mendasarinya. Korban yang melanjutkan untuk mengakses atau memulihkan dompet melalui antarmuka ini umumnya diminta memasukkan frasa benih (seed phrase) atau kunci privat, yang ditangkap oleh operator secara waktu nyata sebelum sesi berakhir.
Momen penyingkapan biasanya tiba ketika korban mencoba mentransfer dana dan mendapati saldonya telah terkuras. Karena pengiriman frasa benih bersifat tidak dapat dibatalkan dan memberikan akses penuh ke sebuah dompet, pemulihan aset pada tahap itu sepenuhnya bergantung pada penelusuran forensik di tingkat blockchain, bukan pada bentuk pembalikan langsung apa pun. Operator di balik infrastruktur domain homograf umumnya meninggalkan domain tersebut segera setelah satu siklus pemanenan, tanpa menyisakan saluran dukungan pelanggan, entitas terdaftar, atau pihak lawan yang dapat diidentifikasi untuk dikejar.
Red flags we documented.
- 01Punycode prefix signals homograph intentThe xn-- prefix in the domain name is not a formatting quirk; it is the technical marker that this domain contains Unicode characters. Its presence in a wallet-adjacent domain name is a near-universal indicator of a lookalike or impersonation operation rather than a legitimate service.
- 02Listed on CryptoScamDB community blacklistThe domain appears in the CryptoScamDB blacklist, a widely-referenced dataset of confirmed malicious cryptocurrency addresses and URLs maintained through community contribution and ongoing verification. Inclusion is a hard signal, not a probabilistic one.
- 03Seed-phrase solicitation is an absolute loss signalAny web interface requesting a wallet seed phrase or private key operates outside all legitimate norms. No genuine non-custodial wallet service requires this for standard access. Submission to an unverified site constitutes an immediate, total, and irreversible transfer of wallet control to the operator.
- 04No legitimate wallet platform uses IDN homograph domainsEstablished cryptocurrency wallet services do not register their primary interfaces under internationalised domain names that incorporate Unicode lookalike characters. Such registrations have no plausible commercial purpose other than deception.
- 05Disposable infrastructure with no verifiable operatorHomograph-domain operations are low-cost to create and trivial to abandon. No corporate identifiers, regulatory licences, or verifiable operator details are associated with this domain, which is consistent with infrastructure designed for a single harvest cycle rather than a sustainable service.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.