{"id":41117,"date":"2021-04-21T09:58:13","date_gmt":"2021-04-21T06:58:13","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=41117"},"modified":"2025-08-30T17:21:17","modified_gmt":"2025-08-30T14:21:17","slug":"fraudsters-clone-bitmains-website-to-steal-cryptocurrency-from-miners","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/fraudsters-clone-bitmains-website-to-steal-cryptocurrency-from-miners\/","title":{"rendered":"Fraudsters clone Bitmain’s website to steal cryptocurrency from miners"},"content":{"rendered":"

Amid a shortage of ASIC miners, a fraud scheme targeting buyers of Bitcoin mining hardware from Bitmain has circulated, according to experts at Kaspersky Lab<\/a>.<\/p>\n

\\n<\/p>\n

Malicious actors send potential victims emails claiming that they are allegedly mentioned in a Google Docs file by a user under the alias BitmainTech. Posing as sales staff, the scammers announce the start of a limited pre-order for Antminer S19j equipment.<\/p>\n

\\n<\/p>\n

\\\"Fraudsters<\/p>\n

Source: kaspersky.com.<\/p>\n<\/div>\n

\\n<\/p>\n

\\\"Fraudsters<\/p>\n

Source: kaspersky.com.<\/p>\n<\/div>\n

\\n<\/p>\n

To lull users into complacency, the emails use the domain @docs(.)google(.)com.<\/p>\n

\\n<\/p>\n

The message also contains a Google Docs file with an active link that, through a chain of redirects, leads to the site bitmain(.)sa(.)com, registered in March 2021, which is a clone of the legitimate bitmain(.)com.<\/p>\n

\\n<\/p>\n

When the user navigates to the Antminer S19j site priced at $5017, it is immediately added to the cart. The user is then prompted to log in or register. Kaspersky Lab experts did not rule out that this method is used to build a database of addresses and passwords for later account breaches.<\/p>\n

\\n<\/p>\n

In the next step the victim is asked to provide a delivery address (presumably for later data sale) and a cryptocurrency payment method \u2013 Bitcoin, Bitcoin Cash, Ethereum or Litecoin.<\/p>\n

\\n<\/p>\n

After this, the criminals provide their own cryptocurrency wallet details and warn that the transaction must be completed within two hours, otherwise the order will be canceled.<\/p>\n

\\n<\/p>\n

As soon as the payment is completed, the order data disappears from the personal account, and the site\u2019s buttons become inactive.<\/p>\n

\\n<\/p>\n

Kaspersky Lab advises always checking the address bar when visiting sites and trusting only information published on the brand\u2019s official page.<\/p>\n

\\n<\/p>\n

ForkLog previously reported that a resident of Amur Oblast fell victim to scammers when purchasing mining equipment. He transferred 53 000 rubles, but in the package from the seller found an old car battery<\/a>.<\/p>\n

\\n<\/p>\n

Subscribe to ForkLog news on Telegram: ForkLog Feed<\/a> \u2014 full news feed, ForkLog<\/a> \u2014 the most important news, infographics and opinions.<\/p>\n","protected":false},"excerpt":{"rendered":"

Amid a shortage of ASIC miners, a fraud scheme targeting buyers of Bitcoin mining hardware from Bitmain has circulated.<\/p>\n","protected":false},"author":1,"featured_media":41118,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[426,1154,1137],"class_list":["post-41117","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-bitmain","tag-crimes","tag-cryptocurrency-mining"],"aioseo_notices":[],"amp_enabled":true,"views":"20","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/41117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=41117"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/41117\/revisions"}],"predecessor-version":[{"id":41119,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/41117\/revisions\/41119"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/41118"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=41117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=41117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=41117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}