Posts warning about cryptocurrency related scams
- Tweets 1,108
- Following 133
- Followers 87
- Likes 270
Every path leads to seed extraction.
• "Diagnostics" and "Insurance" lures prompt users to "Invalidate and generate new seed phrase" or "Confirm recovery phrase".
• Input fields for 12, 20, or 24-word phrases
• Any words entered are sent straight to the drainer.
20
Once a device is clicked, victims are presented with 3 trapdoors:
1️⃣ "Set up new wallet" ➡️ Presents a pre-generated 24-word seed (attacker controls keys)
2️⃣ "Run Diagnostics" ➡️ Fake "Device Memory Corruption" error
3️⃣ "Insure your wallet" ➡️ Bogus asset protection agreement
1
31
🚨 PHISHING SCAM ALERT 🚨
Credential-harvesting domain is actively impersonating the official @Trezor Suite dashboard to drain seed phrases.
🔹 Domain: trezordefi[.]com
🔹 Registrar: OwnRegistrar, Inc.
🔹 Registered: Oct 28, 2026
🔹 Target: Hardware wallet users
1
62
1/3 🚨 Newly registered phishing domain impersonating @binance Vault:
🌐 Domain: liveness-binance[.]com
📅 Registered: 12 October
The site serves a single-page application built to harvest credentials and siphon crypto assets. Technical breakdown 👇
@BinanceHelpDesk
1
124
🚨 Phishing & Web3 Alert: EIP-2612 USDT Drainer on Arbitrum One
usdtverify[.]online
Phishing lure masquerading as an official "USDT Verification" page. The campaign leverages off-chain EIP-712 Permit signatures to steal funds gas-free without an upfront on-chain approve() alert
1
1
283
1/7 🧵 Fake @Ledger Proposal Drops ScreenConnect via DocuSign Decoy
A Web3 phish on ledgerproporsal[.]com lures targets with a fake proposal.
Runs a real DocuSign installer as a decoy while silently installing weaponized ScreenConnect RMM backdoor. 👇
@Ledger_Support
2
1
1
970
🚨 SCAM ALERT: XRPL wallet drainer targeting @XamanWallet
• Domain: ledger-allocation[.]app
• Lure: Spoofed "Xaman Airdrop / XRPL Allocation"
• Vector: Malicious Web3 modal targeting Xaman, WalletConnect, Ledger, Crossmark
Triggers malicious signing payloads to drain assets
167
The scam flow:
Prompts hardware selection (Nano, Flex, Stax)
Simulates a failed connection
Triggers "Use alternative method"
Prompts manual entry of 12, 18, or 24-word recovery phrases
289
🚨 SCAM ALERT: Campaign impersonating @Ledger_Support with a fake "2026 Exploit" advisory claiming $150M in losses.
• exploits2026-ledger[.]app
Lure: Claims older @Ledger devices have weak-entropy seeds via a fake MicroPython/Yasmarang bug to push a "risk scan."
2
1
3
3,710
🚨 SCAM ALERT: XRPL rewards/loyalty campaign pushing wallet drainers:
• badge-xrp[.]com
• xrp-badge[.]com
• xrp-loyalty[.]com -> loyalty-xrpl[.]com
• xrpl[.]im
• xrpl-dex[.]com
• xrp-scans[.]com
"Connect Wallet" prompts malicious signing requests to drain funds.
3
158
🚨 SCAM ALERT: Fake RLUSD reward sites targeting XRPL users with wallet drainers:
• crossmarklabs[.]com (impersonating @crossmarkio)
• honeyclusterx[.]com (impersonating @HoneyclusterX)
"Claim Allocation" prompts a malicious wallet connect modal to drain funds.
1
1
95
Related domain: profilehub-coinbase[.]com
Backend Portuguese C2 panel ("Painel de cartões"):
• Endpoints: POST /c collector & /health route
• Artifacts: Parsers for Brazillian cards (Elo, Hipercard, Aura)
• Actor: Likely Brazilian cybercrime group adapting carding tools
182
🚨 Phishing Alert: @CoinbaseSupport Lure
New gated phishing campaign targeting @coinbase users:
• userhub-coinbase[.]com
• Lure: Fake support ticket / 6-digit "Case ID" via SMS/email
• Kit: Next.js RSC with fingerprinting & bot gating
#ThreatIntel #Phishing #Coinbase
1
250
🎣 The Funnel:
1️⃣ Baits users with promises of 256-bit post-quantum protection.
2️⃣ A slick device picker prompts targets to select their hardware model (Stax, Flex, Nano X/S).
3️⃣ The harvest: Full BIP-39 mnemonic input (12/18/24 words) + passphrase capture.
1
52
🎭 The Setup:
The attackers cloned the legitimate Ledger support center, routing almost all navigation links back to official domains to build trust and evade naive scanners.
The only malicious path? A prominent prompt urging users to enable "post-quantum cryptography".
1
74
Threat actors are weaponizing post-quantum cryptography anxiety to drain hardware wallets.
A new campaign is actively impersonating @Ledger_Support with a fake "Enable Quantum Resistance" flow designed to harvest seed phrases.
Breakdown of the funnel, infra, and IOCs 🧵👇
1
96
🚨 PHISHING ALERT / SEED HARVESTER 🚨
import-metamask[.]com
Impersonating @MetaMask with a fake verification flow:
-Fake CAPTCHA
-Fake "Wallet Suspended" alert
-Credential harvester prompting for a 12–24 word Secret Recovery Phrase
@MetaMaskSupport
186
@Ledger @Ledger_Support
🚨 PHISHING ALERT: SEED PHRASE HARVESTER
ledgerwallethardwareupdate[.]com mimics Ledger with a fake device update. Clicking "Start Update" asks for your 12–24 word seed. Submitting it grants full control to drain all crypto assets instantly.
47
@Support @_SEAL_Org @CloudflareHelp
🚨 Malicious OAuth Alert
New campaign using usexledger[.]xyz (reg: Sept 27, 2026 via @Cloudflare Registrar / AS13335) impersonating an X tipping bot.
1
73
@CoinbaseSupport Active OAuth phishing campaign via coinbase-event-2x[.]com. The site lures victims and redirects them to the legit @coinbase login to authorize a malicious 3rd-party app, bypassing MFA. Please revoke client_id: 258660e1-9cfe-4202-9eda-d3beedb3e118
2
287
Scam domain impersonating @FlareNetworks registered a recently @hostinger. Looks like a copy of the official flare domain. "Access Wallet" button prompts the user to input their seed phrase/private key.
Domain: flare-network[.]site
#fraud #scam #Flarenetwork
cc @HugoPhilion
1
121
@Ripple @bgarlinghouse @xrpforensics
bg-xrp[.]com
drop-xrp[.]com
airdrop-xrp[.]com
brad-2x[.]com
brad-up[.]com
xrpcoin-x2[.]com
xrp-2025[.]com
xrpgives[.]com
ripple-x2coin[.]com
ripple-bonus24[.]com
xrphappy[.]com
brad-xrp2024[.]com
224xrp[.]com
xrp4u[.]com
22
mstrx2[.]com
coinbase2024[[.]]com
eventsaylor[.]com
microstrategy-gives[.]com
mlcrostrategy2024[.]com
microstrategy24[.]com
msevent-official[.]com
mstr-2x[.]com
saylorevents[.]com
saylorgives[.]com
microstrateg[.]com
ms2saylor[.]com
microstrategy-gift[.]com
2
26
@MicroStrategy @saylor
ms2saylor[.]com
microstrategy-gift[.]com
event-microstrategy[.]com
saylor-invest[.]com
bitcoin-saylor[.]com
saylor-event[.]com
mstr24[.]com
invest-saylor[.]com
investing-saylor[.]com
microstrategy-btc[.]com
saylorinvest[.]com
upsaylor[.]com
micro-2x[.]com
2
35
@ethereum @VitalikButerin
eth-airdrop[.]com
ethgive24[.]com
ether2event[.]com
ether2airdrop[.]com
ethereumget[.]com
@Gemini @GeminiSupport
gemini-airdrops[.]com
gemini-giveaways[.]com
2
53
@Binance @BinanceHelpDesk
binancex2[.]com
@Cardano @Cardano_CF
invest-cardano[.]com
cardano2024[.]com
2
29
@Apple @applesupport
applemusk[.]com
apple2024event[.]com
@ARKInvest @CathieDWood
ark-gift[.]com
arkinvestlive[.]com
ark-events2023[.]com
etfark[.]com
48
Hi @bitfinex
This was created on the 12th. Looks to be impersonating your exchange.
domain: bitfinex-au[.]com
#fraud #scam #cybercrime
47
Hi @EvernodeXRPL
This was created on the 12th. Looks like mostly a copy of your wordpress site. Guessing this one isn't yours.
domain: evernodexrpl-server[.]network @namesilo
#fraud #scam #cybercrime #XRPL #XRPLCommunity
58
Hi @BithumbOfficial
This domain was created 4 days ago and looks to be impersonating your exchange
domain: bithumb-bf[.]com
#fraud #scam #cybercrime
31
Hi @BitstampSupport
Looks like a poor attempt to impersonate @bitstamp
domain: bitstamp[.]space
Registrar: @Dynadot
#fraud #scam #cybercrime
1
222
@xrpforensics Scam giveaway site impersonating @Ripple @bgarlinghouse
domain: claim-xrpz[.]com @iisp_hk
#XRP: rfBG1z4FtEmoLHiWeCQ72R4zxsDXX4wLKH
#fraud #scam #cybercrime #XRPCommunity
14
Scam airdrop site impersonating @Ripple @bgarlinghouse
domain: xrps-claims[.]info @iisp_hk
#fraud #scam #cybercrime #XRP
48
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse
domain: event-xrp[.]net
#XRP : rPromowVx4USzjeBrBBqUtGBED5wMzLZqU
Not certain but the wallet may be associated with @bitFlyer @bitFlyerUSA
#fraud #scam #cybercrime #XRPLCommunity
17
Please check again. The site is still operational. See the screenshot from the Hostinger WHOIS Lookup Tool.
2
27
@bitfinex
A recently registered malicious site impersonating your exchange presenting a login page:
www-bitfinex[.]online @hostinger
#fraud #scams #cybercrime
2
94
A few more. First 3 are fake customer service, the last is presenting a fake login page:
gemini-wallet[.]com
gemini-247[.]com
support-gemini[.]net
www-gemini[.]pro
#fraud #scam #cybercrime
47
@PoloSupport Scam site impersonating @Poloniex presenting a fake login page registered 2 days ago:
www-poloniex[.]com
#fraud #scam #cybercrime
42
@GeminiSupport Another scam site impersonating @Gemini presenting a login page to harvest user creds:
wvw-gemini[.]com
#fraud #scam #cybercrime
1
36
Scam site impersonating Flare
flarenetworks[.]net (@Hostinger)
@FlareNetworks @HugoPhilion Do you do anything with scam reports like this?
#flare #fraud #scam #cybercrime
2
1
143
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse :
ripplevent-live[.]com
ripplelive-event[.]com
Address: rH2obcStvjm6zng5TqdJvj5LwYHBox55Gw
Tag: 386456
Address: r9VE2snwXuAecWxzaXNEkpjgzVJqTaMWHo
Tag: 405233
#ripple #XRP #fraud #scam #cybercrime
1
35
@GeminiSupport Here are a couple impersonating @Gemini presenting a login page
gemini-ens-login[.]xyz
gemini-en-login[.]xyz
57
@AskUphold The first two are hosting a login page impersonating @UpholdInc at /secure-login/. The third isn't resolving. All registered two days ago.
uphold-ens-login[.]xyz
uphold-logins-ens[.]xyz
uphold-logins-enus[.]xyz
1
46
@krakensupport @krakenfx @c7five
I THINK this is a half-assed attempt to impersonate your brand. Registered 3 days ago.
wwv-Kraken-Login[.]com
@Ledger_Support The privacy policy page references Ledger Live and this domain:
ledgerliveh[.]com
2
1
175
@BittrexSupport @BittrexExchange @BittrexUS
Scam site impersonating @BittrexGlobal created 3 days ago and hosting a login page
account-bittrexglobal[.]com
1
48
Here is another similar one also created 4 days ago. This one is hosted by @Namecheap
flareportal[.]network
#flare
1
1
152
Looks like a scam impersonating @FlareNetworks Prompts the user to create or import a wallet
flareapp[.]network @tucows
#flare
1
1
175
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse:
xrp2022event[.]net (@tucows)
#XRP: rfxDa7BmozaUyyj4E2RR15syLvVxCWEhmB
#BTC: 1Mnzeq3sDixHEV5CVeNvL5f2ggu1bx1K55
Hosting @cloudflare @cloudflarehelp
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse:
double-xrp[.]live (@NiceNIC_NET)
#XRP: rafsS1qUTYCBRkVsaSb7gz3U1JRFaXBXVx
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site impersonating
@Ripple @bgarlinghouse:
xrp22event[.]net (@tucows)
#XRP: rfxDa7BmozaUyyj4E2RR15syLvVxCWEhmB
#BTC: 1Mnzeq3sDixHEV5CVeNvL5f2ggu1bx1K55
Hosting: @cloudflare @cloudflarehelp
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway sites impersonating
@Ripple @bgarlinghouse:
xrp-ceo[.]info (@savyent)
xrpsec[.]pro (@ru_nic)
#XRP: rJCDKUFUJynmZEe2Q3tGpk1N5mckHYbCeG
rEvEp7698JfYMkjY8Gm3V9ojRDWbtHXknK
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site impersonating
@Ripple @bgarlinghouse:
ripple22news[.]net (@tucows)
#XRP: r4dqr8kSeSaPRL7ZHazMFwSDckUf6Xag7m
#BTC: bc1qly0u39vpt029v8qag8dkhet99xhmsphus4h78s
Hosting: @cloudflare @cloudflarehelp
#ripple #fraud #scam #cybercrime
1
Scam site impersonating @UpholdInc
@AskUphold:
officialuphold[.]com (@GoDaddy @GoDaddyHelp)
Hosting: @cloudflare @cloudflarehelp
#fraud #scam #cybercrime
1
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse:
xrp-usd[.]online (@NiceNIC_NET )
#XRP: r4UxiKYUaYxmrnsxGpuR9UEvzNzAuQt3S5
#BTC: 1KoEoQqWQ3M8YwBfT1e7FwDMjefACqy8vA
Hosting: @cloudflare @cloudflarehelp
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse:
info-xrp[.]com (@REGRU)
Hosting: @cloudflare @cloudflarehelp
#ripple #fraud #scam #cybercrime
1
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse:
xn--2x-xrp-4va[.]com (2xí-xrp[.]com), redirects to telegra[.]ph/Ripple-Labs-Official-XRP-Airdrop-10-04 which contains a @GrabifyDOTlink link that redirects to íxrpdrop[.]com
#ripple #fraud #scam #cybercrime
1
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse:
givingbradxrp[.]com (@namesilo)
#XRP: rpbuMLYNJHR19gjMwJJnaVpS8JMdtVGH5y
Tag: 639585
Registrant Org: @qhostercom
Hosting: @Cloudflare @CloudflareHelp
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse:
xrp2rise[.]com (PDR Ltd)
#XRP: rfjcet23ePwtjsfy7FnTds7Hj7DHRLVDNG
Registrant associated with 30+ other crypto scam domains
#ripple #fraud #scam #cybercrime
1
Scam "Wallet Recovery" site impersonating @MetaMask @MetaMaskSupport:
metamask-web[.]com (@usesav)
#fraud #scam #cybercrime
1
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse :
xrp2rise-live[.]space (PDR Ltd)
#XRP: rNQ7sknZmT5BXHF7Jrb2shUcMeeMD3isJq
#ripple #fraud #scam #cybercrime
1
1
@xrpforensics
Scam giveaway site impersonating @Ripple :
xrpbonus[.]pro (@REGRU)
#XRP: rDQEajcRHk7i5RgPzYxi5fmEdVx72qi78t
Tag: 77777
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse :
info-xrp[.]net (@REGRU)
#XRP: rEdfhFMX8PZDHLvPvUr4t6LQhzAf31b98R
#BTC: 1HYK6zvWxDTPGsz41H6Hok7Q2C1eBbs9JY
#ETH: 0x6825A50682Ee1B16CEe8f5dfd54DC41740DD7FE8
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse :
xrpup[.]live (PDR Ltd)
#XRP: rsxXgYXcZjwu77kKyPZYmojLrRHcN9o6JU
Tag: 77777
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site impersonating @Ripple @bgarlinghouse :
ripplelabs[.]pro (PDR Ltd)
#XRP: rEcy1oF9enf1Pq5RTpESELBoVUdPWZve52
Tag: 351607698
#ripple #fraud #scam #cybercrime
1
2
Scam giveaway site impersonating @tesla @elonmusk
elongo22[.]org (PDR Ltd)
Hosted on @Cloudflare @CloudflareHelp
#BTC: bc1q6j57xahss26twgq447gx46nf6xfl62j88ct0qe
#ETH: 0x0FE8b44C87BB108e15B78848adafDc9F2D3d2b32
#fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site:
collectripple[.]com (@REGRU)
#XRP: rEHUwxwmqCPjWS8ULqb5F4TYSgk35YUhsQ
Tag: 47777774
#ripple #fraud #scam #cybercrime
1
@xrpforensics
Scam giveaway site:
xrp2x-double[.]org (@NiceNIC_NET)
Hosted on @Cloudflare @CloudflareHelp
#XRP: rGyxushCCqxzvk5KQZGfUWecB29tn8mEC4
#ripple #fraud #scam #cybercrime
@xrpforensics
Scam giveaway site impersonating @Ripple:
eventxrp22[.]net (@tucows)
Hosted on @Cloudflare @CloudflareHelp
#XRP: rEPG6kkrF5R33r5dYXrZjd3E2MAxQid4WC
#BTC: bc1qac3lq2gknehtln989qzj53dwpnmeaqk9a0gzuj
#ripple #fraud #scam #cybercrime
