How the scam operates.
この活動は、完全に機能するイーサリアムウォレットのインターフェースを装っており、多くのブラウザで既知のウォレットサービスと視覚的にほぼ同一に表示される国際化ドメイン名(IDN)を悪用しています。生のURLでのみ確認できるPunycodeエンコードは、1つ以上のASCII文字をUnicodeの類似文字に置き換えています。アドレスバーをざっと見る一般的な利用者にとって、このドメインは正規のものに見えます。標的とされるのは、信頼できる自己管理型(セルフカストディ)ツールにアクセスしていると信じている既存の暗号資産保有者です。
その手口は、ウォレット偽装活動について十分に記録されたパターンに沿っています。被害者は通常、自らアドレスを入力するのではなく、ソーシャルメディアやダイレクトメッセージ内のフィッシングリンク経由でたどり着きます。サイトは元のサービスを忠実に模倣したインターフェースを表示します。決定的な段階は、利用者が既存のウォレットをインポートするためにシードフレーズまたは秘密鍵の入力を求められるときに発生します。これらの認証情報はサーバー側で取得され、攻撃者は関連するすべての資金への完全なアクセス権を得ます。
不具合が生じる時点は、すぐに訪れることはまれです。認証情報の取得後もインターフェースは引き続き機能しているように見える場合があり、被害者が気づく前に攻撃者が資産を移動させる時間を与えます。利用者が資金の消失に気づくころには、移動を追跡できる時間的猶予はすでに大きく狭まっていることが多くなっています。IDNスプーフィングの層は技術的な混乱を加え、被害者が侵害の発生経緯を理解するのを遅らせ、その後のあらゆる調査や報告を複雑にします。
Red flags we documented.
- 01Internationalised domain name spoofing a known walletThe domain uses Punycode encoding to substitute a visually similar Unicode character into what otherwise reads as the name of a well-established Ethereum wallet service. This IDN homograph technique is a deliberate attempt to defeat visual inspection and is not a feature of any legitimate financial platform.
- 02Credential-harvesting interface patternWallet-impersonation operations of this type exist to collect seed phrases and private keys. No legitimate non-custodial wallet service transmits or stores a user's seed phrase server-side. Any interface that requests this input and does not process it entirely client-side should be treated as hostile.
- 03CryptoScamDB blacklist listingThe domain appears on the CryptoScamDB community blacklist, a peer-reviewed registry used by browser extensions, wallet software, and security tooling to block known phishing infrastructure. Presence on this list reflects a determination by independent reviewers that the domain poses a direct threat to users.
- 04No verifiable operator or regulatory signalLegitimate wallet interfaces are associated with identifiable organisations, published terms of service, and auditable open-source code. Operations built on spoofed domains cannot satisfy these conditions by design, because doing so would expose the operator and defeat the impersonation.
- 05Off-platform distribution as a delivery signalIDN homograph operations rarely rely on organic search traffic. Distribution typically occurs via sponsored results, social engineering campaigns, or hijacked links in legitimate-looking communications. Arriving at such a domain through any channel other than a personally verified bookmark is itself a warning signal.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.