How the scam operates.
The site presents as a legitimate self-custody Ethereum wallet interface, targeting Ether and ERC-20 token holders. Its domain uses Punycode encoding (signalled by the xn-- prefix) to embed non-ASCII Unicode characters that, when rendered in a browser address bar, produce a URL visually indistinguishable from a widely recognised wallet service. Users arrive believing they have reached a trusted destination.
The operational mechanism is the IDN homograph attack: Unicode characters that visually match ASCII letters in a familiar service name are embedded in the domain at the encoding level. Victims arriving through a phishing link, a manipulated search result, or a near-miss typographical error encounter an interface mirroring a legitimate wallet tool. The site solicits a seed phrase, private key, or keystore file to ostensibly unlock a wallet; those credentials are transmitted to the operator upon submission, granting full control of every associated address.
The breach is typically silent. The site may simulate a brief loading state before going blank or returning an error; no explicit signal of the theft is shown. Victims generally discover the loss hours or days later, when funds are found swept to an unrecognised address. By that stage the assets have usually been moved through layered transfers intended to frustrate tracing, and the window for on-chain intervention has closed.
Red flags we documented.
- 01IDN Homograph Domain ConstructionThe xn-- prefix identifies this as an Internationalized Domain Name using Punycode to embed non-ASCII characters that produce a visual clone of a legitimate service URL. This technique has no genuine application in consumer financial services; its documented use in this context is credential phishing.
- 02CryptoScamDB Blacklist InclusionThe domain is recorded on the CryptoScamDB community blacklist, a reference used by wallet developers, browser security extensions, and anti-phishing infrastructure. Independent third-party identification of this kind reflects active recognition of the domain as harmful.
- 03Credential Solicitation Through a Web InterfaceLegitimate self-custody wallet tools do not accept seed phrases or private keys through a browser form connected to a remote server. Any platform requesting these credentials via a web interface is operating contrary to foundational cryptographic security practice.
- 04Complete Operator AnonymityNo company registration, named personnel, regulatory licence, or auditable operational record has been documented for this site. Structural anonymity of this kind is a deliberate feature of phishing infrastructure, not an administrative oversight.
- 05A Pattern That Defeats Standard Safety PrecautionsUnlike phishing that relies on social engineering alone, an IDN homograph operation defeats a specific precaution: verifying the URL bar. Victims who follow standard safety guidance and check the domain before entering credentials may still be deceived, as the threat operates at the character-encoding level rather than the content level.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.