Fraudsters are trying to make money amid the coronavirus pandemic and the fight against it. In particular, at the beginning of this week the number of spam mails allegedly on behalf of the World Health Organization (WHO) has increased. The letters speak of fundraising for COVID-19 Funds worldwide.

Specialists of the portal SICP.ueba.su analyzed one of these letters, which was sent from This email address is being protected from spambots. You need JavaScript enabled to view it.. It turned out that the second-level domain is actually used by WHO, but it was this letter that was sent from a mail server located in the state of Colorado in the United States of America and in transit passed through a reference mailer in the German municipality of Mauern.

Experts also learned that a link to a picture with a QR code (the address of a bitcoin wallet for donations) leads the reader directly to the portal of the investment company Five Stand Capital, located in the US city of Atlanta from Georgia. As follows from the official information on the company's website, it is a partner of large US investment funds in the United States. The portal itself is hosted by GoDaddy in Oregon (Portland). Still there are three site mirrors - for various domain zones.

This email was first sent from the SendGrid.net mail server, which is also located on GoDaddy’s resources in Colorado, Denver. And, judging by the information bases, another 13 resources are located on this IP address, nevertheless, only one of them is displayed - a web-based mail gateway.

It is important to consider that on the official website of the WHO there is no way to donate funds in the form of cryptocurrency - bitcoin. The same is true of their dedicated donation collection site. And there is even a warning that they do not send any letters.

Apparently, fraudsters are trying to cunningly take advantage of the global crisis situation, possessing a good knowledge of modern technology. Or maybe the owners of WHO decided to use all available tools to raise funds. And experts are wondering, where is the hosting site for WHO?

Interestingly, so far, no funds have been received to the cryptocurrency wallet, which is indicated in the letter of the scammers. The wallet is constantly monitored by SICP platform experts, however, like other malicious purses known to them.

Source: CryptoRussia.ru

All investigations and political actions of blogger Alexei Navalny begin immediately after large cash receipts come to his bitcoin wallets, the owner of Internet-Rozysk, Igor Bederov, told the Krasnaya Vesna correspondent on November 6.

He said that his company is developing unique services for the prevention and investigation of crimes intended for law enforcement and security services: “You should start the story with the fact that we are developing the first domestic service designed to trace cryptocurrency transactions - SICP | Security Intelligence Cryptocurrencies Platform."

Igor Bederov recalled that Navalny “uses several cryptocurrency bitcoin wallets to finance his activities,” and spoke about the results of monitoring the status of these wallets.

“What are these wallets? The first wallet 3QzYv * (the wallet number is at the disposal of the publisher) was used in 2691 transactions. In total, 633.28146173 Bitcoins came to this wallet, which is 378 196 391.89 rubles. at today's rate.

The second 3MQTR wallet * (wallet number is at the disposal of the publisher) was used in 666 transactions. A total of 72.80104198 Bitcoins came to this wallet, which is 43,476,863.08 rubles. at today's rate, ”the specialist shared information.

He drew particular attention to the fact that the activities of the opposition are “tied” to the proceeds of his Bitcoin wallets: “During the monitoring of these wallets, we clearly see that all his investigations or political actions take place immediately after receiving a large monetary tranche.”

Igor Bederov noted the difference between such large tranches and the receipt of money from Navalny’s supporters: “Such tranches are very specific and very different from the usual donations from FSC supporters. An ordinary supporter of Navalny can transfer him an amount of 100 rubles. and up to 15 thousand rubles. maximum. And these are direct transactions that go from wallet A to wallet B.

At the same time, large transfers that precede stocks and FSC investigations start at 3 million rubles. And these transactions are far from simple. They mix bitcoins, hide information about their real sender in a heap of parallel transactions."

In conclusion, he emphasized that after the analysis it was possible to establish that the sender of such tranches may be located in the USA: “However, we were able to analyze several chains of such transactions and determine that the probable sender of funds may be located in the United States.”

Note, on October 9, the Ministry of Justice of Russia recognized FSC as a foreign agent.

And in mid-October in 30 headquarters of the headquarters of the Anti-Corruption Fund, the Investigative Committee of the Russian Federation conducted searches. They took place in the framework of the criminal case of money laundering by FSC employees, as well as their receipt of money from abroad. FSC accounts were arrested.

On November 5, the Levada Center released data according to which a third of Russia's residents call criminal cases against the Navalny Fund protection of the country from foreign influence and the fight against money laundering.

Source: Red Spring.

Since the spring of this year, a project called CloudToken is actively developing and promoting the network, positioning itself as "the first wallet in the world that integrates all crypto assets of the blockchain on one platform." Their goal is to provide project participants with a special ecosystem of public savings.

The project supports 7 major cryptocurrencies and stablecoins, 21 referral levels, has a mobile application (wallets in leading marketplaces) and offers its participants a yield of 6 to 12% per month, as well as 150-fold profit (!) For 2019. At the same time, the first participants (top of the pyramid?) Are promised support for the issuance of payment cards.

The project attracts its participants (the number of which, according to some estimates, has already exceeded 800,000 people) with the help of the so-called "network leaders" from around the world. For example, in Russia and neighboring countries, Pavel Chernyshev is engaged in resource promotion.

Information on the project website is presented in English and Chinese, the legal entity Cloud Technology and Investment Pty., LTD is registered in Australia, and the United States is indicated as the geolocation of the site. Currently, 145 countries are involved in the scheme.

The process of making a profit is described on the resource as follows:

1. Participants send funds to ETH / BTC in the Jarvis bot asset management pool.

2. A tool called Varoom collects data from over 38 cryptocurrency exchanges.

3. Varoom transfers assets to the Jarvis AI BOT.

4. Varoom instructs Jarvis.

5. Jarvis trades on exchanges.

6. Information is collected on the latest prices at CoinMarketCap.com.

7. Members receive rewards in CTO tokens.

8. The rest of the earned funds are transferred to the Jarvis Asset Reserve.

9. Jarvis Asset Reserve supports the rate in the conversion wallet.

10. Participants can convert CTO to ETH, BCH or other cryptocurrency at any time.

The mobile application offered for download is positioned as a cryptocurrency multi-wallet with passive income (while funds can be sent in only one direction), as well as a trading bot (without confirming trading volumes). Nevertheless, judging by the volumes, the funds received from participants (victims?) Are immediately transferred to controlled sites and cold wallets.

According to an investigation conducted by the experts of the cybersecurity resource SICP (sicp.ueba.su), the total amount of funds that have passed through only one wallet currently exceeds 6 billion rubles, and this figure is constantly growing.

In particular, as a result of the investigation, it was found that all the main assets of the CloudToken project are transferred to the South Korean crypto exchange Upbit, and also are withdrawn through wallets in Thailand (in some cases they are frozen).

Below is some more evidence that the CloudToken project is just another pyramid scheme.

1. Despite the fact that the organizers of the project position it as a “completely decentralized cryptocurrency wallet”, in fact it’s hard to even call it a wallet. In fact, users only get access to the server, where they see their tokens. Judging by the CloudToken tracker on Etherscan, all it can boast of is 4 addresses and 5 transactions, with 99.9999% of the funds held at one address. Thus, buyers give their money, but do not become owners of the coveted tokens.

2. In the promotion of the service involved people who have repeatedly advertised fraudulent schemes.

3. Lack of evidence of trading using the Jarvis bot. Although representatives of the project claim that they generate profit using the Jarvis AI Bot bot, which is used for arbitrage trading on exchanges, there is no evidence of such trading on the resource.

4. Cryptocurrency pyramid based on the Ponzi scheme. Project participants on the referral side need to replenish their account by at least $ 500, after which they will be able to receive commissions for attracted people. In this case, commissions are paid up to level 21. It is unlikely that such a scheme can last long.

5. Lack of use cases. CloudToken does not have application scenarios in the real world, it can only be purchased from developers, and no token exchanges accept. The price of the token is not supported by anything, the demand for it is artificial. The company can change the value of the token at any time.

6. Lack of access to CTO wallet private keys. Users do not receive secret keys from the "wallet", instead they are given a password or PIN code.

7. The promise of high return on investment. Most projects that promise high investment returns actually turn out to be scams, unless the program has official registration and regulation.

8. Invalid information. The White Paper of the project mentions the names of people who have nothing to do with the project.

From the foregoing, we can conclude that CloudToken does not have a secure cryptocurrency wallet, its founders do not trade on the exchange and deceive investors. In addition, the project is advertised by well-known network scammers, and the CloudToken address is involved in the services of doubling bitcoins and the distribution of paid prohibited content.

Source: CryptoRussia.ru

PlusToken crypto wallet, which proposed storing almost all the world's leading cryptocurrencies and making a profit on their investments, can claim the status of the largest fraudulent project in the history of financial pyramids. Users cannot withdraw the equivalent of $ 3 billion from their online wallets.

PlusToken, an international decentralized crypto project of the multi-currency online wallet PlusToken, was launched in April 2018. The project was positioned by the creators as developing a team from South Korea using Samsung technology. The marketing campaign was launched in Asia (China, Japan, South Korea, Myanmar, Vietnam), a number of European countries (Germany and the UK), as well as in Russia.

In addition to the ability to store almost all the world's leading cryptocurrencies in the wallet - Bitcoin, Bitcoin Cash, Ethereum, XRP, EOS, IO, Litecoin, Doge and Dash, users were promised a fairly significant return on investment of their cryptocurrency assets - from 6% to 19% per month.

According to experts from Elementus (USA), a company that creates and promotes fintech solutions based on blockchain technology, over 800 thousand Ethereum cryptocurrency depositors have used PlusToken wallets for the entire existence of the project and stored about 10 million ETH on them.

According to the Special elaborations department of the Technopark of St. Petersburg, the PlusToken pyramid attracted about 200 thousand bitcoins, 789 thousand ETH and 26 million EOSIO. All these funds went to wallets controlled by the PlusToken team.

However, interested media write, these estimates are very preliminary, and the amount collected from investors may be much larger. So, experts say, only the Ethereum address of PlusToken stored more than 781,000 ETH, which, in terms of the exchange rate, amounts to more than $ 234 million.

The capitalization of PlusToken at the top of trading reached $ 17 billion. PlusToken was accused of fraud in March 2019, when Chinese police raided PlusToken's offices in Hunan (PRC). The head of PlusToken's Chinese unit, Chen Bo, as well as five other Chinese citizens related to the cryptocurrency wallet project, have disappeared and are on the wanted list.

Problems with the withdrawal of assets from PlusToken wallets began in late June 2019. The Chinese investors were the first to suffer, as evidenced by the entries in the PlusToken support service, which did not respond to calls, and, starting on June 29, the PlusCoin platform token exchange rate remained at the same level ($ 139,237) without hesitation.

On June 29, according to the Dailypost, six Chinese citizens suspected of participating in an Internet scam were arrested on the island of Vanuatu at the request of the Chinese authorities and deported back to China. It is possible, the publication reports that they are precisely the key figures in the PlusToken team.

To date, it is known that the organizers of PlusToken have already managed to cash out part of the bitcoins through crypto exchanges Huobi Global (Singapore) and Bittrex (USA). In particular, the Singapore cryptocurrency exchange got almost half of the funds raised for wallets - about 4.3 million ETH. The other part was transferred to one of the cryptocurrency wallets.

It was possible to track the funds of defrauded investors thanks to the cryptocurrency transaction analysis service created in the Special elaborations department of the Technopark of St. Petersburg.

According to experts, the obvious signs of the financial pyramid of the PlusToken project were tracked from the very beginning. Among them, the referral system of distribution of funds offered to investors, which is characteristic of financial pyramids and MLM marketing, and unjustifiably high monthly profit (from 6% to 19%.). The PlusToken fraudulent scheme is already being compared with the principles of organizing the BitConnect closed cryptocurrency platform. It entered the market through an ICO at the end of December 2016, and by the end of 2017, its BCC tokens have established themselves as one of the fastest growing cryptocurrencies. She guaranteed her investors a 40% return for a month. According to CoinMarketCap, in a fairly short time, BCC capitalization reached $ 2.6 billion, and the ATH rate was $ 460. But in January 2018, BitConnect unexpectedly for its investors announced the closure of the exchange and the lending program, notifying them that they would continue to provide services as a wallet, but at the same time change the format to a media platform. Immediately after this announcement, investors fell into a panic, and the BCC rate lost 96% of the cost.

It is interesting to note that in Russia until now, users have access to the PlusToken mobile wallet, which can be downloaded from the GooglePlay and AppStore stores. For the storage of their crypto assets in the wallet, Russian investors are still guaranteed a profit of 6% to 19% monthly. True, the “blog” section of PlusToken’s Russian site is currently inactive (or deleted), and all consultations are invited to receive via WhatsApp.

Source: IT News.