How the scam operates.
The operation presents as a functional Ethereum wallet interface. By registering a domain whose Punycode encoding (xn--metherwallet-3ml.com) renders visually near-identical to a widely-used Ethereum wallet service when displayed in certain browsers, the operator positions the site to intercept traffic from users who either mistype the legitimate address or follow a spoofed link. The surface presentation mimics the expected layout of a self-custody wallet tool, targeting holders of Ether and ERC-20 tokens.
The mechanics rely on an IDN homograph attack, a technique in which one or more Unicode characters replace visually similar ASCII letters in a domain name. The browser address bar may display the decoded form of the domain, making it appear genuine to a user who does not inspect the underlying Punycode string. Victims who proceed to access or recover a wallet through the interface are typically prompted to enter a seed phrase or private key, which the operator captures in real time before the session concludes.
The moment of discovery usually arrives when a victim attempts to transfer funds and finds their balance already drained. Because seed-phrase submission is irreversible and grants full access to a wallet, asset recovery at that stage depends entirely on blockchain-level forensic tracing rather than any form of direct reversal. Operators behind homograph-domain infrastructure typically abandon the domain shortly after a harvest cycle, leaving no customer-support channel, registered entity, or identifiable counterparty to pursue.
Red flags we documented.
- 01Punycode prefix signals homograph intentThe xn-- prefix in the domain name is not a formatting quirk; it is the technical marker that this domain contains Unicode characters. Its presence in a wallet-adjacent domain name is a near-universal indicator of a lookalike or impersonation operation rather than a legitimate service.
- 02Listed on CryptoScamDB community blacklistThe domain appears in the CryptoScamDB blacklist, a widely-referenced dataset of confirmed malicious cryptocurrency addresses and URLs maintained through community contribution and ongoing verification. Inclusion is a hard signal, not a probabilistic one.
- 03Seed-phrase solicitation is an absolute loss signalAny web interface requesting a wallet seed phrase or private key operates outside all legitimate norms. No genuine non-custodial wallet service requires this for standard access. Submission to an unverified site constitutes an immediate, total, and irreversible transfer of wallet control to the operator.
- 04No legitimate wallet platform uses IDN homograph domainsEstablished cryptocurrency wallet services do not register their primary interfaces under internationalised domain names that incorporate Unicode lookalike characters. Such registrations have no plausible commercial purpose other than deception.
- 05Disposable infrastructure with no verifiable operatorHomograph-domain operations are low-cost to create and trivial to abandon. No corporate identifiers, regulatory licences, or verifiable operator details are associated with this domain, which is consistent with infrastructure designed for a single harvest cycle rather than a sustainable service.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.