How the scam operates.
coindash.ru は、暗号資産のポートフォリオ管理ツールまたは取引インターフェースを装っており、別のトップレベルドメインを用いて正規に運営されているプラットフォームが築いた知名度に便乗しています。.ru での登録は、本来のサービスを検索している利用者や、その名称を誤って記憶している利用者を引き寄せる狙いがあり、その表示画面は元のサービスと機能的に同等であるかのように見せかけて設計されています。
TLD 置き換え型のなりすましプラットフォームに特徴的な手口では、正規のポートフォリオ追跡や取引活動を装い、利用者に暗号資産ウォレットの接続、API キーの入力、または取引所の認証情報によるログインを促します。ひとたびアクセス用の認証情報やシードフレーズが送信されると、運営者は被害者によるそれ以上の操作を要することなく保有資産を流出させることが可能になります。
この詐欺は通常、利用者が接続したウォレットや取引所アカウントから不正な送金を確認した時点で表面化しますが、その段階では運営者はすでに資金の流出を完了し、ドメインを停止または別のものに差し替えていることが一般的です。被害者は匿名の運営者に対して取り得る手段を持たず、ブロックチェーン取引が不可逆である性質を踏まえると、送金された資産は従来の手段では事実上回収不能となります。
Red flags we documented.
- 01TLD substitution impersonating a recognised platformThe .ru domain registration mirrors the naming convention of a legitimately operating cryptocurrency service on a different top-level domain. This substitution is a documented technique for capturing misdirected traffic and exploiting brand trust without authorisation from the legitimate operator.
- 02CryptoScamDB blacklist confirmationcoindash.ru appears in the CryptoScamDB community blacklist, a collaboratively maintained database of confirmed-fraudulent cryptocurrency domains. Blacklist inclusion indicates the domain has been independently identified and reported as malicious by community investigators.
- 03.ru TLD registration inconsistent with legitimate international operationRussian-country-code TLD registrations are frequently employed by operators seeking to distance their infrastructure from jurisdictions with active enforcement capacity. For a platform presenting as a cryptocurrency service oriented toward international users, the .ru registration offers no operational advantage and is consistent with deliberate jurisdiction evasion.
- 04Credential entry as prerequisite for core functionalityPlatforms of this category typically require wallet connections, seed phrase entry, or exchange API key submission before any service is rendered. This structural requirement is the primary mechanism through which the operator obtains access sufficient to exfiltrate holdings, with no legitimate analogue in properly designed non-custodial services.
- 05Single-session operational pattern with no post-breach accountabilityTLD-substitution operations of this pattern are characterised by brief operational windows, the domain exists to capture credentials, not to sustain a business. Once sufficient victims have engaged, operators typically abandon or cycle the domain, leaving no contractual relationship, regulatory filing, or identifiable party against whom victims can pursue claims.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.