How the scam operates.
このドメイン名は、主要なEthereumウォレットサービスを連想させるよう構成され、世界的に知られる技術企業に関連付けられたトップレベルドメインと組み合わされています。その結果、表面的な見え方として、二つの信頼されるブランド間の公式な製品連携、あるいは正式な提携であるかのように被害者に映る可能性があります。当該サイトは、正規のウォレットインターフェースの視覚的なデザインを複製している公算が大きく、Ethereumベースの資産を保有または管理する利用者を標的としています。こうした利用者は、検索結果、ソーシャルメディアのリンク、あるいはフィッシングメールを経由して到達することがあります。
この類型のサイトは、認証情報を窃取するためのインターフェースとして機能します。訪問者がウォレットへのアクセスまたはインポートを試みると、当該プラットフォームは秘密鍵、ニーモニック・シードフレーズ、または暗号化されたキーストアファイルの入力を求めます。これらの認証情報は、いったん送信されると、デバイス上でローカルに処理されるのではなく、運営者へ送信されます。運営者はその後、取得した認証情報を用いて被害者のウォレットに自律的にアクセスし、資金を抜き取ります。これは通常、送信から数分以内に、被害者によるその後の操作を一切伴わずに行われます。
この不正は、被害者が取引を行おうとして残高がすでに見知らぬアドレスへ移されていることに気づいた時点で明らかになります。この段階では、当該送金はオンチェーン上で取り消すことができません。運営者は通常、一定期間にわたり活発に認証情報を窃取した後にドメインを放棄し、機能する連絡先も、サポート窓口も、被害者がプラットフォームと直接、何らかの紛争解決や回復手続きを開始する手段も残しません。
Red flags we documented.
- 01Domain constructed to mimic a recognised wallet brandThe domain combines a name closely associated with a well-established Ethereum wallet service with a top-level domain tied to a major technology company. This pairing is a deliberate impersonation signal, not an affiliation. No legitimate wallet provider operates under such a domain construction, and neither referenced brand has any documented connection to this property.
- 02Confirmed listing on CryptoScamDB community blacklistThe domain appears on the CryptoScamDB blacklist, a community-maintained repository used by wallet providers and browser security tools to flag known phishing infrastructure. Inclusion reflects reported harm, not merely theoretical risk, and indicates the domain has been reviewed and flagged by the fraud-monitoring community.
- 03No verifiable operator identity or regulatory standingThere is no verifiable company registration, regulatory disclosure, or terms of service associated with this domain. Legitimate wallet services, whether custodial or non-custodial, maintain auditable legal identities. This operation presents none of those attributes, which is consistent with infrastructure designed for short-term exploitation rather than sustained legitimate service.
- 04Credential solicitation is the central operational patternPhishing platforms of this category are built around a single objective: capturing wallet credentials. Any interface that requests a private key, seed phrase, or keystore file outside of a locally-verified, open-source application environment should be treated as a hostile data collection point, regardless of how legitimate the visual presentation appears.
- 05No operational history, community presence, or audit trailThe domain has no documented operational history, independent security audit, or active user community. Operations that carry no verifiable track record and simultaneously appear on fraud databases are consistent with short-lived phishing infrastructure, deployed quickly, exploited, and abandoned before victims can coordinate a response.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.