How the scam operates.
Domain ini memakai sistem nama domain terinternasionalisasi (IDN) berbasis Punycode untuk menyusun alamat web yang tampil identik secara visual dengan layanan wallet Ethereum yang sudah dikenal luas pada sebagian besar peramban. Domain dasarnya, ketika diterjemahkan, mengandung substitusi karakter yang tidak kasat mata pada bilah alamat. Operator menyajikan situs ini sebagai platform wallet self-custody yang tepercaya, diposisikan untuk mencegat pengguna yang tiba melalui URL yang salah ketik, hasil pencarian, atau tautan phishing yang dibagikan.
Model operasinya adalah pemanenan kredensial. Pengunjung biasanya dihadapkan pada antarmuka yang menyalin alur masuk atau pemulihan wallet, yang meminta seed phrase, private key, atau berkas keystore. Ketiga masukan ini merupakan satu-satunya mekanisme yang memberikan kendali penuh atas sebuah wallet mata uang kripto. Setelah dikirimkan, informasi tersebut diteruskan kepada operator, dan pada titik itu dana korban menjadi dapat diakses tanpa memerlukan interaksi lebih lanjut. Serangan ini tidak memerlukan malware dan tidak meninggalkan jejak pada perangkat korban.
Keruntuhan ini kerap tertunda secara sengaja. Sejumlah implementasi mengalihkan korban ke layanan asli setelah kredensial ditangkap, sehingga mempertahankan ilusi sesi yang normal. Pengguna mungkin tidak menyadari ada yang salah sampai mereka mencoba melakukan transaksi dan mendapati saldo mereka telah terkuras. Pada saat itu, dana biasanya telah berpindah melalui satu atau beberapa alamat perantara, dan jejak on-chain dengan cepat mendingin. Tidak ada mekanisme untuk membalikkan transfer tersebut; pemulihan bergantung pada deteksi dini dan pelacakan investigatif terhadap wallet tujuan.
Red flags we documented.
- 01IDN Homograph Domain PatternThe xn-- Punycode prefix indicates this domain contains a Unicode character substitution designed to mimic a legitimate wallet address. This is a recognised attack technique against cryptocurrency users; no genuine wallet service registers its primary domain in this encoding.
- 02CryptoScamDB Blacklist InclusionThe domain appears in the CryptoScamDB community blacklist, a collaboratively maintained registry of phishing infrastructure. Inclusion follows community review and indicates the domain has been verified as fraudulent by independent researchers.
- 03Seed Phrase Solicitation SignalWallet impersonation platforms of this type invariably request recovery phrases or private keys. No legitimate self-custody wallet requires a user to submit a seed phrase through a web interface to access an existing wallet. Any platform making this request should be treated as hostile.
- 04No Verifiable Operator IdentityThere is no documented corporate registration, regulatory standing, or named operator behind this domain. Legitimate wallet services, whether custodial or non-custodial, maintain transparent organisational identity and are reachable through official channels.
- 05Irreversible Loss ExposureCredential theft of this kind results in on-chain fund transfers that cannot be reversed or disputed. Unlike bank fraud, there is no institutional recourse. Recovery depends entirely on early detection and, in some cases, investigative tracing of destination addresses.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.