Fake customer support webpages

[ovcijisir]

Just wanted to share my experience with fake customer support when I tried to find support when reconstructing legacy wallet for Celo wallet. The reason I tried to reach out for help is  because the wallet I was using was discontinued and I tried to find a way to find compatible wallet I could use seed phrase on

Other wallets for same altcoin had different derivation path so my seed words were useless unless I find somd other compatible wallet.

Immediately after writing my post I received few dm's and it seems they all acted independently, but they were following same procedure.

They sent me information in DM where they claimed that they opened support ticket for "customer support" on my behalf and they gave me link to external website.

They also added to give support ticket number to their customer support.

The link they gave me in DM lead to external webpages with customer support dedicated to scamming, so I guess that by having expense of running "customer support" webpage that their operation pays off. Also just the number of different websites dedicated to this scam tells us in how much danger unsuspecting newbie is.

Lesson that should be learned from my experience:
1. ALWAYS check the links before clicking them by hovering your mouse over them and checking complete URL.

2. Be suspicious of people who you don't know and that is your first contact with them but are too eager to help.

List of scam customer support websites that tried to rob me that way (some are not active anymore, but I added them for archival reasons):

Code:

https://quicksresolve.com/
https://archive.is/HoUZt

https://chain-decentralizefix.web.app/
https://archive.is/lUs9N

https://livechat.zenidesk.com/
https://archive.is/ihKjx

https://daajinc.com/
https://archive.is/BBzIx

https://livesupport.lingbk.online/
https://archive.is/8jKZP

[lovesmayfamilis]

I think in our age of AI, no payback is needed to create a fake support service or fake reviews. If earlier scammers used fake photos of representatives of their organizations, stealing information from people who were completely far from their fraud, today AI helps in literally everything, from support services, and a multifaceted one, to fake video communication. The conclusion today should be one: do not trust not only your ears but, unfortunately, also your eyes, and double-check everything that seems natural several times.

[Shishir99]

This is the most common scamming method. I assume you have used a Discord server to reach them, and those people sent you private messages and sent those links, right? This is common when you are Discord server of an exchange or wallet. These scammers always wait for people who will look for support, and they reach you pretty fast, as if they are the official support.

As you already know, the support never supposed to DM you first regardless your condition. They would ask you to create a ticket on the same server and someone will be there to help you. Private message = Red flag. Never chat with anyone in DM.

[SmartGold01]

My joy here is that you were clever enough to detects and senses a wrong move, like you knew on time that something was phishing so you easily detected it. You post made me to have that thinking that whenever there is an issue we should at least try as much as possible to not go easily accept those people that quickly ran to us to help us because these people are dedicated scammers who are just acting as an eye service to pretend as if they wanna help but dip down inside they really wanna milk us from our hand earned money..

[Zwei]

i had the same thing happen to me here on the forum a few months ago: https://asktom.cf/index.php?topic=5535453.0

they send those PMs to everyone on the forum and other platform who are looking for help with thier crypto, wallets, etc...
i'm not one to fall for something like this (i'm sure many others are the same), but the fact this group of scammers have been doing this possibly for months now shows they are quite successful at scamming people with this method, else they would not be wasting their time.

Code:

https://chain-decentralizefix.web.app/
https://archive.is/lUs9N

https://livesupport.lingbk.online/
https://archive.is/8jKZP

i have reported both of the sites that are still live.

the first one to google, since it's hosted on firebase: https://safebrowsing.google.com/safebrowsing/report_phish/
and the second to namecheap, as the domain is registered there: [email protected]

[khaled0111]

Thank you for the warning OP, and as a rule of thumb, you should always be careful and never trust personal messages from random people.
If you have a problem, avoid asking about it on public platforms like telegram discord.. always try to reach out to customer support via their official channels.

In your case, since the wallet website seems to be down, you should have used Google to search for the information you are looking for or just asked here and I'm pretty sure many members would have helped you.

In case you didn’t figure it out yourself untill now,. I did a quick search and found that the derivation path Celo wallet used to use is: m/44'/52752'/0'/0
https://forum.celo.org/t/deprecating-the-celo-derivation-path/9229
Hope this helps!

[ovcijisir]

I think in our age of AI, no payback is needed to create a fake support service or fake reviews. If earlier scammers used fake photos of representatives of their organizations, stealing information from people who were completely far from their fraud, today AI helps in literally everything, from support services, and a multifaceted one, to fake video communication. The conclusion today should be one: do not trust not only your ears but, unfortunately, also your eyes, and double-check everything that seems natural several times.

This is sad truth, that AI will be used more and more for such things. Before we could detect scammers easier because they used bad grammar and made unprofessional looking messages and e-mails. Now it is all available at the click of the button, for bad and for good. Like you said, we can not trust our senses now, but think logically before every action. I am most afraid for unexperienced members who don't know what to expect and could fall to scams easily.

This is the most common scamming method. I assume you have used a Discord server to reach them, and those people sent you private messages and sent those links, right? This is common when you are Discord server of an exchange or wallet. These scammers always wait for people who will look for support, and they reach you pretty fast, as if they are the official support.
~

It was actually on official Celo forum, and I was very surprised that there are so many scammers lurking there. I understand these things can happen in Discord and Telegram but it was their official forum, I was surprised that scamming it at so big scale.

~

Code:

https://chain-decentralizefix.web.app/
https://archive.is/lUs9N

https://livesupport.lingbk.online/
https://archive.is/8jKZP

i have reported both of the sites that are still live.

the first one to google, since it's hosted on firebase: https://safebrowsing.google.com/safebrowsing/report_phish/
and the second to namecheap, as the domain is registered there: [email protected]

Thank you for reporting them Zwei! The more report we send, the sooner they will close and less people will get scammed

Thank you for the warning OP, and as a rule of thumb, you should always be careful and never trust personal messages from random people.
If you have a problem, avoid asking about it on public platforms like telegram discord.. always try to reach out to customer support via their official channels.

In your case, since the wallet website seems to be down, you should have used Google to search for the information you are looking for or just asked here and I'm pretty sure many members would have helped you.

In case you didn’t figure it out yourself untill now,. I did a quick search and found that the derivation path Celo wallet used to use is: m/44'/52752'/0'/0
https://forum.celo.org/t/deprecating-the-celo-derivation-path/9229
Hope this helps!

Thank you for advice and article! In the end I found the derivation path, but have not yet recovered the wallet. I yet have to install Celocli software and recover it from there. I'll probably do it in next few weeks when I find more time. I'm not in hurry to sell it yet considering the current price.

[albon]

It was actually on official Celo forum, and I was very surprised that there are so many scammers lurking there. I understand these things can happen in Discord and Telegram but it was their official forum, I was surprised that scamming it at so big scale.

Any forum or discussion forum like the official Celo forum, Reddit, Quora or this forum, you will find many scammers who may contact you once they see that you have asked a question, are in need of help or once you reveal what cryptocurrencies you hold or that you have lost or had your coins stolen.. That’s why it was good that you stayed alert when you came across those fake webpages that were sent to you.

There are also scammers who may share a real-looking link but embed a hidden fake link inside it. To avoid this, you can right-click on the link, select copy link address, and verify it before opening.

I hope your topic serves as a lesson to beginners in the forum,, not to trust strangers or anyone who messages them first, and to be cautious before using any wallet or opening any link.

[ovcijisir]

Just a little update, I have received one more scamming message to contact fake "customer support" on following website:

Code:

https://websync-validation.vercel.app/
https://archive.is/eGqiM

[khaled0111]

^^
It looks like Vercel is a kind of a free hosting service. So, those thieves are too cheap that they don’t even want to invest few bucks on buying a proper domain and hosting plan.

I guess you will keep receiving such phishing messages as long as your post on that forum is up and visible for everyone. If you already got the help you were looking for, then it’s better to delete that post or lock it, if that’s possible.
If you are receiving those messages from members of the said forum, you can also try reporting them. This won’t stop them but it will, at least, slow them down a bit.

[Zwei]

^^
It looks like Vercel is a kind of a free hosting service. So, those thieves are too cheap that they don’t even want to invest few bucks on buying a proper domain and hosting plan.

that, but they also use those hosting services like vercel.app, pages.dev, web.app, to not get blocked by filters, as those domains/services have high trust rating compared to a new domain.

I guess you will keep receiving such phishing messages as long as your post on that forum is up and visible for everyone. If you already got the help you were looking for, then it’s better to delete that post or lock it, if that’s possible.

or he can keep the post up as bait, so he can post those websites here so we can report them, but it's up to him if he want to do that.

[ovcijisir]

~

I guess you will keep receiving such phishing messages as long as your post on that forum is up and visible for everyone. If you already got the help you were looking for, then it’s better to delete that post or lock it, if that’s possible.
If you are receiving those messages from members of the said forum, you can also try reporting them. This won’t stop them but it will, at least, slow them down a bit.

All the "support offers" I got were sent in dm, not one was made public. I won't delete the post because the answers I got from other members were pretty useful and can help someone who is in same situation as me.

~

I guess you will keep receiving such phishing messages as long as your post on that forum is up and visible for everyone. If you already got the help you were looking for, then it’s better to delete that post or lock it, if that’s possible.

or he can keep the post up as bait, so he can post those websites here so we can report them, but it's up to him if he want to do that.

That was exactly my intention, every report we make is one step closer to some unsuspecting victim being saved. Scams like this are painting Bitcoin in wrong light.


BTW. recently I watched interesting documentary about how scams like this actually operate. I was surprised at the level of organisation they have.

Inside A Merciless Scam Empire (short documentary)

[ovcijisir]

A little update about this scam. A lot of scam websites that are previously exposed ate now inactive, but there are some new ones:

Code:

https://livesupport.online-garantis.com/
https://archive.is/d2r5I

https://livechatdesks.web.app/
https://archive.is/dJBGd

https://livesu.pportgroup.cc/
https://archive.is/2h51G

https://securefix.pages.dev/
https://archive.is/PfWGi

https://syncwebs.io/
https://archive.is/wip/PnDAu

One weird thing I noticed is that some of the links (sycwebs) could not be archived. When trying to archive it there is error message "Not Found (yet?)". I guess they blocked archive.is from accessing their website and making archive copy.

[ovcijisir]

I did a little research and found one more fake customer support webpage, it uses the samd template as somf of webpages mentioned above.

Here is a link to the webpage and archived copy:

Code:

https://liveserver-synchronizedprotocol.online
https://archive.fo/nExCJ

[AgriTrack]

This is sad truth, that AI will be used more and more for such things. Before we could detect scammers easier because they used bad grammar and made unprofessional looking messages and e-mails. Now it is all available at the click of the button, for bad and for good. Like you said, we can not trust our senses now, but think logically before every action. I am most afraid for unexperienced members who don't know what to expect and could fall to scams easily.

I agree, that’s a reasonable argument about the misuses of AI tools. As we know this is a serious issues about AI because there is a lot of scams reported which are linked with AI because AI can speak and write accurately and it's voice is also very realistic so anybody can be trapped easily through this. So in current situation we can't trust on what we see on social media or other platforms and its a very practical problem which may face majority of people everyday so what's the solution. The best solution is that we should use logic and verify information which creat suspense. Mostly inexperienced users are at high risk of scam. So we should be aware of negative use of AI Although with the positive view AI as it is a very helpful platform for us but its misuse increased very fastly.

[MinMan]

I did a little research and found one more fake customer support webpage, it uses the samd template as somf of webpages mentioned above.

Here is a link to the webpage and archived copy:

Code:

https://liveserver-synchronizedprotocol.online
https://archive.fo/nExCJ

I tried opening the webpage just to see how it looks and what it asks for, and it seems like the webpage is down, maybe they moved to a new domain because this one got flagged, because if they have received some traffic, there must have been some reports. I have MetaMask installed in my browser, and it also warned me about the webpage having potential for being a phishing website.

Despite all this, some newbies will still get trapped and scammed by these tactics, because these scammers are very active on Telegram and as soon as someone sends a message in a chat group asking for assistance, they send DMs immediately pretending to be the team members who are trying to help the user solve their problem, and someone with no experience would think it's true.

[ovcijisir]

~
The best solution is that we should use logic and verify information which creat suspense. Mostly inexperienced users are at high risk of scam.
~

As the scams become more and more elaborate, the logic becomes the best way to avoid them. But unfortunately a lot of newbies became interested in crypto unprepared and not willing go invest time to learn things properly. They want every solution resolved instantly,so it isnt surprise that scams like this are flourishing. I hope that at least some of them will try to make a google search about the site they are using for crypto "tech support" and avoid stupid mistakes like entering their seed on malicious webpage or something like that.

~
I tried opening the webpage just to see how it looks and what it asks for, and it seems like the webpage is down, maybe they moved to a new domain because this one got flagged, because if they have received some traffic, there must have been some reports. I have MetaMask installed in my browser, and it also warned me about the webpage having potential for being a phishing website.

Sites like this tend to go offline and then back online from time to time, my guess that they are changing hosting provider when someone reports them as malicious, or maybe doing some experiments.

~
Despite all this, some newbies will still get trapped and scammed by these tactics, because these scammers are very active on Telegram and as soon as someone sends a message in a chat group asking for assistance, they send DMs immediately pretending to be the team members who are trying to help the user solve their problem, and someone with no experience would think it's true.

That is exactly how I came in contact with those sites. I got swarmed by fake tech support and they tried to steer me away to their fake "issue solving" pages.