How the scam operates.
当該ドメインは、完全に機能するセルフカストディ型のイーサリアムウォレットプラットフォームを装い、広く認知されたサービスのインターフェースおよびブランドを視覚的に複製しています。これは国際化ドメイン名（IDN）のホモグラフ技術によって実現されており、ドメインラベル内の1文字以上が、多くのブラウザや動作環境において標準的なラテン文字と同一、あるいはほぼ同一に表示されるUnicodeの代替文字に置き換えられています。アドレスバーを軽く確認しただけでは、当該ドメインは正規のドメインと区別がつきません。
被害者の多くは、ソーシャルメディアのメッセージ、メールキャンペーン、または検索連動型広告を通じて拡散されたフィッシングリンク経由でアクセスします。サイトは正規のプラットフォームを模倣するよう設計されたウォレットインターフェースを表示し、利用者にシードフレーズ、秘密鍵、またはウォレットの認証情報の入力を求めます。これは通常、ウォレットのインポート、アカウントの復元、またはセキュリティ確認の手順を装って行われます。入力された認証情報はローカルで処理されるのではなく運営者へと送信され、運営者は関連するウォレットに保管されている資金へ即座にアクセスできるようになります。
この詐取が明らかになるのは、ウォレットの資金が抜き取られた後、または被害者が後続の操作を試みてサービスが応答しないことに気づいた時点のみです。その段階では、提出された認証情報や鍵はすでに使用された後です。運営者は露見の度合いが高まると通常はインフラを放棄し、追跡可能な主体も、被害者が発生した事態を争ったり覆したりする手段も残しません。
Red flags we documented.
- 01Homograph domain masking a recognised wallet brandThe domain uses punycode-encoded Unicode character substitution to construct a URL that is visually indistinguishable from a well-known, legitimate wallet service. This technique serves a single operational purpose: deceiving users who do not scrutinise address bar content or verify TLS certificate details before entering sensitive credentials.
- 02CryptoScamDB community blacklist inclusionThe domain is listed in the CryptoScamDB blacklist, a collaboratively maintained register of addresses associated with credential theft, phishing, and asset-draining operations. Inclusion reflects prior harm or credible evidence of fraudulent intent submitted by the security community.
- 03Credential-capture architectureWallet impersonation platforms of this pattern are built specifically to harvest seed phrases and private keys rather than to provide any genuine custody function. Any web-based interface requesting these credentials should be treated as hostile, regardless of how accurately it replicates a trusted platform's visual design.
- 04No verifiable operator identity or registrationOperations built on disposable homograph infrastructure typically present no licensed entity, no regulated address, and no accountable company name. The structural anonymity is not incidental; it is the mechanism that allows the operator to exit without consequence once victims begin to raise the alarm.
- 05Phishing-dependent traffic patternDomains of this type are not discovered through organic navigation; they reach victims via targeted phishing messages, hijacked social media accounts, and paid placements. The reliance on deceptive distribution channels is itself a signal that the platform cannot survive scrutiny in any direct comparison with the service it impersonates.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.