Pay Commission to Receive Bitcoin Scam

This scam is all over the place at the moment, and concerns only people who already have Bitcoin and are being targeted to deposit a small sum in order to ostensibly receive a much larger reward. The system works something like this. You receive an email that takes you through to a Google drawing that consists of something like this:

The drawing is just a shortcut to a website that attempts to defraud you as below:

So the pattern is that you are taken through to some sort of company that represent some type of poorly defined group that send =each other cryptocurrency for sketchy reasons. This 'group' will often infer that you have received the email in error so as to make you believe you are about to receive Bitcoin due someone else. This is a tactic to prevent you from reporting what happens.

Another part of this scam is that the amount of money is not huge, it is a few hundred dollars, and so their is not a huge impetus to recover the funds as with a boiler room scam. This scam is about volume, and about automation. They have moved away from call centre scammers and towards automated online scamming systems. This whole system is nothing more than an animation that pretends you have received Bitcoin and that all you need to do to receive $30k of bitcoin is to pay $249 worth. It is that simple.

This system is far more difficult to trace than previous boiler room-type scams, as there are no accents to listen to, no phone numbers to query, and no questions to ask. it is just a website linked from a Google drawing that is hidden behind proxies and privacy companies and is difficult to even begin to seek out. Let's see how far we can get anyway.

How does the Bitcoin Transfer Scam Begin?

So here is a typical email from the scammers:

From: mancine xz7x <[email protected]>

Sent: 11 August 2023 09:36

To: Steve FcKay

Subject: ?? Personal Notification.TRANSFER 0.7372416 BTC

 

Dear user!

? Personal Notification for ID[N2PZ8X14]

? Previously, we notified you by email about the receipt of a crypto transfer in your name.

The sender is an online crypto service , the recipient is your email address.

https://docs.google.com/drawings/d/1vPAOao2E2Od1jpHH22egIkjSobrmOkWqw7oHsYUd6yA/preview?991tz3360

The message is a bit garbled, but it seems to be saying that we have received some sort of incoming transfer of Bitcoin, but it does not appear to be to our wallet, but to some unknown service that has chosen us by mistake. It just states that 'the sender is an online crypto service' and we're not sure what other type of crypto service that you could ever have, but let's see where it takes us.

So we can see that the link takes us through to: https://docs.google.com/drawings/d/1vPAOao2E2Od1jpHH22egIkjSobrmOkWqw7oHsYUd6yA/preview?

Now this is just a preview, as you can see from the URL above. If we remove the code subsequent to the forward slash, we can see the actual Google document and report it, as below:

So, now that we can report these links, let's find out what the scam actually consists of: We are sent through to a website with URL https://paymetev.stimularcrypto.website/info/

The get transfer button takes you through to the rest of the scam, which is on a file called server.php which then takes you through to num1a-komisbilling.php, whatever that means.

Here is where the animation takes you through the supposed transfer process:

And brings you to the part where you have to pay in advance to receive your (or rather someone else's) Bitcoins:

Which takes you through to a payment service: https://paymentsvip.gq/

This is a real payment that you have to make in BTC and this is where they take your money. As we said earlier, there is now no human element in the scam at all. It is completely automated and very hard to trace. Let's see if we can find out anything about the different elements of the scam.

Firstly, let's start with the domain. Who are stimularcrypto.website?

Whoisology finds nothing:

Which is very odd, this domain is registered somewhere really obscure and unseen.

Who.is finds nothing either...

Domaintools.com finds:

Registrar

PDR Ltd. d/b/a PublicDomainRegistry.com IANA ID: 303 URL: https://publicdomainregistry.com Whois Server: whois.PublicDomainRegistry.com (p)

We have emailed details of the website to them in the hope that they will take action.

The IP address appears to be 95.142.40.55 so what is that?

Well according to RIPE, there is this: