So Who are Well firstly, talk about desperate when it comes to domain names! A .c

So Who are

Well firstly, talk about desperate when it comes to domain names! A .club suffix for a recovery company. They really are scraping the barrel. Next, let's have a look at how they contacted us. They used our test mailbox which has filled in forms on Bitcoin Circuit, Bitcoin Rush and Brexit Millionaire and so they must have access to the addresses on that list. This means that they are affiliated with the scammers themselves in some way, a fact that seems to resurface over and over.

The IP address they are sending from is a known IP spam source on UCEProtect:

Their domain name email source - - sounds like one of the spammer domains that Bitcoin Loophole tend to reside at. The whole site is suspicious as it does not even work on SSL secure mode, indicating that it is a short-lived site, ready to be discarded as soon as its usefulness has been outlived.

What is the Website?

The website appears to be a single page template website, a little like our website that seeks to prevent people signing up with bad recovery agents. It takes minutes to make and means nothing. There is no sign of any registered company name or address or even a phone number, just a typical submission form with no obvious destination address. 

They really have entered the minimum text here - Scam Victim? Leave Your Details To Get FREE CONSULTATION From Our Team - They couldn't even be bothered to write a free consultation or are you a scam victim? The mind boggles as to what their thinking really is. 

Who Are

Excellent Question. Well, like most of these scammers, they are hiding behind Cloudflare services so that their IP address and hosting provider cannot be discovered. This shows that they are very concerned about being traced as their website itself has hardly any investment, and yet they are prepared to pay to disguise their identity.

In terms of discovering their identity, there is simply not much to go on. We can see a list of the other sites at their IP now that they have moved providers and appear to be the the Nederlands and using NForce. As we can see from the below, there are a lot of questionable sounding financial sites on this server ( which we have emphasised:



So in particular, and are familiar websites to us that have been investigated on these pages in the past. 

We have tried reporting them to their host in the hope that something will be done...

Add comment