How the scam operates.
The site presents itself as a legitimate Ethereum wallet service, borrowing its name directly from one of the most recognised non-custodial wallet interfaces in the cryptocurrency space. The branding signals are designed to reassure users accustomed to the genuine product, with the expectation that familiar terminology will lower their guard. The target audience is Ethereum holders managing self-custody wallets, who may arrive via search results, social media links, or phishing messages pointing to the domain.
Operations of this type typically function by presenting a replica interface that requests the user's private key or seed phrase under the guise of account access or recovery. Once entered, the operator gains irrevocable control of the associated wallet. Because Ethereum transactions are immutable and require no third-party authorisation, funds can be drained immediately and without recourse. The impersonation is reinforced by the domain name itself, which reproduces the target brand character-for-character before appending a fabricated top-level domain suffix.
The failure point becomes apparent when the user attempts to access their wallet through the legitimate service and finds assets are no longer present. At that stage, the phishing site has typically ceased to respond, and no operator contact details are available. Because credentials were voluntarily entered from the network's perspective, blockchain transactions offer no reversal mechanism. Victims are left with on-chain evidence of the transfer but no practical means of pursuing the recipient address without specialist investigation.
Red flags we documented.
- 01Non-standard domain suffix signals an illegitimate operationThe '.active' top-level domain is not recognised by the Internet Assigned Numbers Authority, which maintains the authoritative registry of valid TLDs. A legitimate wallet service would not operate on a non-standard or fabricated domain extension. This alone is sufficient grounds for immediate suspicion.
- 02Name mimics a recognised Ethereum wallet platformThe domain reproduces the exact name of an established Ethereum wallet interface, differing only in the top-level domain. This pattern, known as brand impersonation or typosquatting, is consistently associated with credential-harvesting operations that rely on users recognising the name without inspecting the full domain.
- 03Listed on the CryptoScamDB blacklistThe domain appears in the CryptoScamDB blacklist, a community-maintained registry of confirmed fraudulent cryptocurrency addresses and domains. Inclusion indicates the site has been reported and verified as malicious by independent reviewers, placing it in confirmed rather than suspected territory.
- 04Credential-entry interface carries irreversible riskAny interface requesting a private key or seed phrase outside of a hardware wallet signing flow should be treated as a hostile surface. There is no legitimate operational reason for a web-based wallet interface to require this information. Entry of these credentials constitutes immediate and total loss of wallet control.
- 05No traceable operator or regulatory registrationNothing in the available record indicates this operation is registered with any financial authority, has a disclosed legal entity, or provides verifiable contact information. The absence of operator transparency is consistent with a disposable phishing asset rather than a legitimate service.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.