How the scam operates.
This operation presents itself as a legitimate Ethereum wallet interface. By exploiting the internationalised domain name (IDN) system, the domain encodes a non-ASCII character within what appears, in most browser address bars, to be the name of a well-known self-custody wallet platform. Visitors arriving via phishing links, search results, or misremembered URLs encounter no obvious visual signal that they have landed on a counterfeit property.
The operational mechanics follow the canonical wallet-phishing template. Once on the page, the interface solicits the information that grants unconditional access to a cryptocurrency wallet: typically a seed phrase, private key, or keystore file. These credentials are the absolute master keys to any self-custody wallet. Submitting them to a third-party interface, regardless of how authentic it appears, constitutes an irreversible transfer of custody. The operator captures submitted credentials and empties the associated wallets, frequently within minutes of receipt.
The breakdown becomes apparent when victims observe unauthorised outbound transactions on-chain or find their balances zeroed without explanation. At this stage the operator has already routed funds through additional addresses, often employing mixing services or cross-chain bridges to complicate tracing. The interface offers no support channel, no dispute mechanism, and no refund path. Recovery, where it is possible at all, requires on-chain forensic analysis to establish a transaction trail before assets are fully dispersed.
Red flags we documented.
- 01Punycode homograph domain obfuscationThe xn-- ACE prefix in this domain signals an internationalised character embedded in the label. Many browsers render such domains in decoded Unicode form, making them visually indistinguishable from the legitimate platform they imitate. This is a deliberate deception technique, not a coincidence of registration.
- 02CryptoScamDB blacklist inclusionThe domain is listed in the CryptoScamDB community blacklist, a widely-referenced registry maintained by the cryptocurrency security community. Inclusion reflects independent identification as a malicious property, corroborating the confirmed-scam verdict.
- 03Credential-harvesting interface patternPhishing sites of this type are engineered specifically to solicit seed phrases, private keys, or keystore files. No legitimate self-custody wallet service requests these credentials through a web interface under any circumstances.
- 04No verifiable operator or legal identityThere is no documented company name, regulatory registration, jurisdiction, or accountable individual associated with this domain. Legitimate financial service operators publish verifiable legal entity details; the absence of any such information is a material warning signal.
- 05Confirmed-scam classification, not provisionalThis domain carries a confirmed-scam verdict rather than a watch-list or investigation-pending status. That distinction matters: it reflects a finding, not a suspicion, and aligns with the technical evidence of IDN-based impersonation.
What you can do now.
Open a free 24-hour case assessment with CryptoLeek +
Tell us what happened. A senior analyst reads your file within 24 hours and replies with an honest yes/no/conditional on recovery. The assessment is free. If we cannot recover the funds we say so plainly, including which (free) regulator channel you should use instead. If we accept the case, we open a numbered case file and issue a written quote for a flat investigation retainer before any work begins, scoped to case complexity, the jurisdictions involved, and the on-chain trail.
Trace your funds on-chain with our analysts +
We trace stolen crypto across BTC, ETH, EVM L2s, Solana, Tron, and major stablecoins using the same toolchain as regulators and tier-1 exchange compliance teams. The output is a forensic report anchored to specific transaction hashes and block heights, the evidence that exchanges, payment processors, and counsel actually act on. Recovery starts here.
Recover with counsel where civil action makes sense +
Where the trace lands in a jurisdiction with cooperative banks and courts, we coordinate with bar-licensed counsel in our 40+ jurisdiction network for civil action and asset-freezing orders (Mareva-style). Counsel bill you directly; the CryptoLeek investigation retainer is independent of counsel fees. The outcome is funds released back to your nominated wallet or bank account.