2 bad urls
one of them targets uniswap, but also had polkadot option (site already revoked)
the other one is is the usual fake multi wallet connect protocol
also saw
MyPolkaDotWallet.com
polkadotwallet.io
No eminent danger, just cyber squatting, same vendor that wanted 200K for a domain polkadot.co (lol nice high hopes)
I am seeing a lot of domains which I am having trouble classify.
They are all named polkadot something (gold, advanced, bank) and always come up with a blank page only with an email address.
advancedpolkadot[.]com - "info@blockchain.st"
goldpolkadot[.]com - "info@blockchain.st"
polkado[.]com - "info@blockchain.st"
polkadotbank[.]com - "info@blockchain.st"
I would like to check with the team if this email rings any bells.
If not I suggest to blacklist those just in case, despite them not serving bad content right now.
My suspicion is that those could be used for
- cybersquatting (re-sell domains for higher price)
- SEO reputation gains (and future advertisement placement on yahoo, duckduckgo or google leading to the fake polkadot clones showing on top)
- GeoFenced phish - serving contents only to users of a particular country.
* Update all.json
2 more bad "polkastarter" URLs
Both share the same hoting IP via DNS A 185.104.45.68
* Update all.json
Co-authored-by: Jaco Greeff <jacogr@gmail.com>
polkadot-promo.net
advancedpolkadot[.]com - "info@blockchain.st" 💁♂️😕
goldpolkadot[.]com - "info@blockchain.st" 💁♂️😕
polkadot[.]casa/#top-widget1 - some sort of bitcoin ponzi, not related to DOT, ignoring
polkadotsevent[.]com - landing page, will monitor it
polkadot365[.]com - landing page, will monitor it
polkadotbank[.]com - "info@blockchain.st" 💁♂️😕
Not necessarily polkadot phishing per se, more like rug pull / pump and dump token abusing the projects good name and image.
polkastarter.ai
Suspect bad "contract" 0x7b1Df8e80ce3F5AF35ed4B9c971916A7f62c847D
Fake ICO
Instead of smart contract it is simply a wallet.
It is not a polkadot wallet though, erc20/eth, but due to the fact that it uses "polkastarter" and the purple dot branding adding for completeness.
Add new bad URL
Bogus token "0x6B39f494fb6c9b1193f9E0fBd2Ed3d9D2Be2b18f"
Fake sence of urgency - hurry only 40 minutes left until sale ends bla bla.
Bad wallet shared with nansen.
The same IP also hosts a fake UniSwap clone and so on.
Pretty high confidence this is a future phish targeting polkadot, due to the deceptive domain name and bad IP used in numerous other scams historically.
Nuking in advance.
https://urlscan.io/ip/162.0.215.24
Add new bad URL, registered today, on bad IP hosting only scams.
polkadot-airdrops.live [198.187.29.28]
Scam is not even set up yet.
Staying ahead of the scammers!
adding freshly registered (today) polkadot-airdropevent[.]network - on the same IP there is also a fake wallet stealing mnemonic seed -
2021-03-22 connectionwallet.live
2021-03-22 connectionwallet-link.live
Mich
