It was a week ago, when I got an invitation to check out a website. And not just a site, a whole new world of excitement. Tesla is launching its own crypto money (called a coin/token), and its own metaverse (suck it, Facebook!), and even its own wallet. How great, you can add all the various cryptocurrency you collected and worked for so hard all into this one new wallet. And buy NFT's. Maybe even hitch a ride on a magical unicorn. And more.
It was pretty late at night, at twelve minutes past two, and everyone knows nothing good happens after two o'clock. Ask your mother. So I thought I would just quickly check out the site before going to bed. Here's the link, but don't go there, and that's why I'm typing it like this: Tesla Presale Token DOT org.
Ah, a trustworthy dot org domain. And what a site. Beautiful. Black background like that of space, planets, stars, wonder. It opens with an animation of a modern space rocket flying among the stars, with Tesla written on it, complete in the same font Tesla woud use.
Everything on the site screams the companies Tesla and SpaceX is behind the site - actually, it says so too - and per implication, the word's hero that will deploy planet B before us humans can overpopulate ourselves out of fresh air.
A trustworthy company, a great guy named like nobody else (you know any other Elon Musk?), and therefore, get ready to become filthy rich and fly over the moon. If you want to get rich you must follow the big money and big names, it is Space Rocket Science 101.
Barely a touch of the mousewheel down is a big countdown timer, something about the tokens not being for sale anymore after 2 days, or something like that. It doesn't say, but it is creating that sense of urgency. Brilliant move, Vladi Puti or whomever you are behind the site.
A counter just like that of a rocket about to blast off, and you better make sure you don't miss out on the space bus. The psychology getting you to depart with your money is everywhere on the site. And since it is Tesla, that is what you actually wants to do.
Like the space jet, but needs some more convincing? A further scroll expedition down lays out the wonders of the new coin. SpaceX will use it. Tesla will use it. Hundreds of companies (red flag!) already accept it. Crypto exchanges are beating down Elon's door to trade the token. The coin is already worth 1.17 US dollars each. Not just a new coin, no, as we all expect, Elon Musk with his big plans and goals is also creating a whole new metaverse for us minions.
I am not talking about those long, long sales pages with the buy-now button at the bottom that Clickbank 'gurus' love so much. Oh no. This site is really professional, and looks and smells like the real deal. It looks exactly like the site of a great company entering the crypto world will look like.
9 out of 10 visitors will fall for the real slimy goal behind the site without realizing its real purpose...
We crypto afficianados all hate Facebook and wants to keep evil Mark Zuckerberg and his dead eyes out of our new playground, so let us play in Elon's sandpit on Mars instead. Plus, why not get yourself the free Tesla wallet too while you're here, where you can store all your Dogies and BTC's and you name it in there.
Sounds too good te be true.
And it is.
The site is very real, but also very fake.
As I pardoned myself already at the top of this article, I was pretty tired and not listening to my gut feeling when I first got onto that site. And I knew I would not want to wade the next day through the so many places where I store info, looking for where I saved info about the site. I feared I may even forget or postpone making work of it.
So I made the elementary mistake most people will make, I fell right into the real trap: I signed up for a free account. That way I would not forget where the site is (I use many browsers and devices), and even receive reminders, and get important announcements and free airdrops and free lessons for unicorn-flying lessons.
That, getting you to sign up, is the one true goal of the slimeballs behind the site. Don't have money now to buy tokens? Still sign up, man. Want to check out this new world of wonders first? Just sign up, man. Want to remain in the loop around the sun? Just sign up now.
With new token launches there's always the possiblitly of a free airdrop, so who's not going to sign up? It takes just a minute. And you can always unsubscribe from the newsletter, and Tesla won't spam you with unrelated stuff or sell your personal info to marketers, is what we all believe. Which is true, except that neither Elon Musk nor any of his companies are behind this website.
Okay, so I signed up for a free account. Not just an email address, they want a name and telephone number as well. That was another red flag I ignored. Why my phone number? I gave them one anyway. Because Elon won't phone me at midnight to offer me an extended car warranty. I hope.
Creating a password is necessary too to open an account on the website. They don't give you one, you need to create one yourself, as with most sites. Many people in our day and age still use the same password for many sites, or just a small alteration to it each time. 9 carats become 18 carats then for a hacker with an imposter website that can spot a pattern in that password he gets to see in plain text. (Cannot really call the site in question spoofed, since Tesla do not have such a site yet that can be spoofed.)
All of us knows the value of a working email address. But pair it with a phone number and some other details, and a hacker has some real gold to work with. Add a newly-created password to the mix to learn some patterns of how the user creates passwords, as a small cherry on top.
I'm happy to say that I provided a long, random password, and blurred email address (compliments from Abine, check them out, or use Firefox Relay), and a very special phone number.
Anyway, at that stage I was still confident that the site is legit. Even said so on Ecency a day later to some people.
I forgotten a bit about making work of the site, till I got some enquiries on Ecency about the new token I mentioned in a comment. And so, I went to do some sniffing.
First, checking my emails. The confirmation email for the new account was there, with a link I should click to confirm. Pretty standard, and going to the correct domain.
But since when will an American company make elementary spelling mistakes in their email? Well, I learned that 'activate' can be spelled 'active.' And one or two more that most people won't even spot in their confirmation emails. But immediately I realized something smelled like fresh twenty-day-old fish.
Over to Presearch (as good as Google, and they pay you in cryptocurrency for searches), to see what I could find about https://teslapresaletoken.org and some reviews.
As to be expected, the scammers dragged their deception to social media as well. What company won't have a presence on social media? Facebook features in the search results, although I haven't yet checked out the FB page. (Feel free to go pop the link to this article there.) With Elon Musk not being a fan of FB, I found it a bit odd though. And no links to some other major social media sites one would expect.
Also, no announcement on Tesla's official website about their new currency, metaverse, and wallet. Plus, naturally, scam review sites among the top ten search results.
Scam-detector.com is a well-known crusher of scammer dreams, and enjoys a credible reputation. I headed over there, and found what I already knew: This token site Tesla Presale Token DOT org is as fraudulent as they come. It gets the lowest possible score on review sites. So much for that pretty template, huh.
I then did a quick WHOIS search on the domain name. Hiding registrant details for privacy reasons is pretty standard with many domains, but I did find it odd that a company like Tesla would want to hide such details.
But, the bummer lays in the 'IS' on there. Not Islamic State, but IS for Iceland. Beautiful country. Green, unlike Greenland that's ice all over. Wonderful people, all 300 000 of them minus a handful of criminal factory rejects like bankers.
And definitely zero chance that Tesla would register the website for such a major shift in business activities in that country. See, common sense is a tool in a hacker's arsenal.
My guess though is that the scum behind the website in question aren't Icelandic, but from one of its neighboring countries. Maybe pointing a directional antenna over the border and scooping up some coffee shop Wifi, if you know what I mean. With the site looking so professional it is a safe guess that the crooks would knew how to cover their tracks in several ways. We can of course call all the people in Iceland and ask them 'hey are you a loser too pathetic to do honest work?', but it will take up most of my day making all those calls.
An option would be to contact ICANN, that supposedly overseas all domain registrations, and file a complaint. The domain will be seized, and the hackers will lose a whopping one thousand cents. That's like ten dollars, or whatever a .org goes for nowadays. Will it be a loss to the scammers? Not really. I expect the site to go down any day. Just for it to pop up three days later elsewhere with a new template and new domain at another registrar.
What the hackers would have gained during their short criminal stint is invaluable: Data from hundreds of thousands of gullible wanna-have-crypto-gimme-gimme people. And one doesn't change your phone number as easily as your email address. SIM swaps are a real thing, and increasing. Googling someone's phone number delivers more valuable data the user thought was private.
Basically, this deceptive website is a setup to eventually get to your crypto wallets in future. That's the new gold rush for hackers that will topple ransomware hacks this year.
I didn't want to spent too much time and effort on this story, so I just hopped on over to Twitter, and posted a screenshot underneath an Elon-tweet where he complains about annoying advertisements for NFT's. I'm sure he has the time to everyday read through the thousands of comments each of his tweets get, so he'll see mine and save his company's reputation by buying out Iceland and shutting off their internet.
Moral of this story: Be very careful with a gazillion new sites that will pop up this year, claiming to be that of brand name companies. Stick to credible sites like Leo Finance and others that can be verified. And make sure to use really secure browsers like Firefox (Chrome is spyware) before visiting such sites. Check the crap out of all sites before giving any of your goodies away.
Toodaladoo for now, I'm off to go buy some crypto in the new Barbie Doll metaverse.
TAGS:
#scam #Tesla #hacking #review #crypto #cryptocurrency #phishing #fake #alert #airdrop #metaverse #wallet
IMAGE SOURCES:
All screenshots I took are of the website in question, and my one tweet on, well, Twitter.