2024-08-09-scam-impersonating-legit-crypto-exchange.txt

2024-08-09 (FRIDAY): SCAM IMPERSONATING LEGITIMATE CRYPTOCURRENCY EXCHANGE PLATFORM

AUTHOR:

- Shehroze Farooqi

REFERENCES:

- https://www.linkedin.com/posts/unit42_crypto-investment-scam-activity-7227787244084846593-X28q
- https://x.com/Unit42_Intel/status/1822021625413353824

NOTES:

- We recently discovered a scam that appears to be impersonating the Nominex, a legitimate cryptocurrency exchange platform.
- The scam page can be accessed directly through a website or through an Android mobile app that uses webview.
- This scam is promoted on platforms like YouTube and Telegram.

DOMAIN USED FOR THIS SCAM:

- Domain name: nmxquantify[.]com
- Registrar: NameSilo
- Registration date: 2024-05-16

WEBSITE PROMOTING THIS SCAM:

- URL: hxxps[:]//nmxquantify[.]com/
- Certificate issued by: Google Trust Services
- Certificate issued on: 2024-07-14

ANDROID APPLICATION:

- SHA256 hash: e3e4163263d65cd9de073cc564c4ab8be31c418c40eeb25af38fcfbfb063e6d9
- File size: 5,546,634 bytes
- File type: Android .apk file
- File location: hxxps[:]//api.nmxquantify[.]com/nmxquantify.apk

A YOUTUBE CHANNEL WITH VIDEOS PROMOTING THIS SCAM:

- hxxps[:]//www.youtube[.]com/@Nominex_Quantify

TELEGRAM CHANNEL FOR THIS SCAM:

- hxxps[:]//t[.]me/NMX_English

ASSOCIATED TELEGRAM USER:

- hxxps[:]//t[.]me/NMX_Quantify