How the scam operates.
O site se apresenta como uma interface legítima de wallet Ethereum de autocustódia, mirando detentores de Ether e tokens ERC-20. Seu domínio usa codificação Punycode (sinalizada pelo prefixo xn--) para incorporar caracteres Unicode não-ASCII que, ao serem exibidos na barra de endereços de um navegador, produzem uma URL visualmente indistinguível de um serviço de wallet amplamente reconhecido. Os usuários chegam acreditando ter alcançado um destino confiável.
O mecanismo operacional é o ataque de homógrafo IDN: caracteres Unicode que correspondem visualmente a letras ASCII no nome de um serviço conhecido são incorporados ao domínio no nível da codificação. As vítimas que chegam por meio de um link de phishing, de um resultado de busca manipulado ou de um pequeno erro de digitação encontram uma interface que reproduz uma ferramenta de wallet legítima. O site solicita uma seed phrase, uma private key ou um arquivo keystore sob o pretexto de desbloquear uma wallet; essas credenciais são transmitidas ao operador no momento do envio, concedendo controle total sobre cada endereço associado.
A violação costuma ser silenciosa. O site pode simular um breve estado de carregamento antes de ficar em branco ou retornar um erro; nenhum sinal explícito do roubo é exibido. As vítimas geralmente descobrem a perda horas ou dias depois, quando os fundos são encontrados drenados para um endereço desconhecido. Nesse estágio, os ativos normalmente já foram movimentados por meio de transferências em camadas destinadas a dificultar o rastreamento, e a janela para intervenção on-chain já se fechou.
Red flags we documented.
- 01IDN Homograph Domain ConstructionThe xn-- prefix identifies this as an Internationalized Domain Name using Punycode to embed non-ASCII characters that produce a visual clone of a legitimate service URL. This technique has no genuine application in consumer financial services; its documented use in this context is credential phishing.
- 02CryptoScamDB Blacklist InclusionThe domain is recorded on the CryptoScamDB community blacklist, a reference used by wallet developers, browser security extensions, and anti-phishing infrastructure. Independent third-party identification of this kind reflects active recognition of the domain as harmful.
- 03Credential Solicitation Through a Web InterfaceLegitimate self-custody wallet tools do not accept seed phrases or private keys through a browser form connected to a remote server. Any platform requesting these credentials via a web interface is operating contrary to foundational cryptographic security practice.
- 04Complete Operator AnonymityNo company registration, named personnel, regulatory licence, or auditable operational record has been documented for this site. Structural anonymity of this kind is a deliberate feature of phishing infrastructure, not an administrative oversight.
- 05A Pattern That Defeats Standard Safety PrecautionsUnlike phishing that relies on social engineering alone, an IDN homograph operation defeats a specific precaution: verifying the URL bar. Victims who follow standard safety guidance and check the domain before entering credentials may still be deceived, as the threat operates at the character-encoding level rather than the content level.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.