People are getting scammed from spoof sites exploiting the "Airdrop" offered by the popular Omise-GO token.
NOTE: NEVER give out your private key for any wallet!
The official Omise-Go website is https://omise.co
Information regarding this scam approach has been out there for the last two months, unfortunately these scam sites are still in full swing and claiming victims daily.
Currently, there is a fake OmiseGO Twitter account (OmiseGO@OmiseWallet) that has been promoting the spoof website to claim your airdrop.
This Twitter account has been active for nearly a month with 13.3K followers. If you dig slightly deeper at the followers it appears many of these followers are fake accounts. The fake twitter account has another sneaky approach of retweeting official OmiseGO@omise_go tweets that pulls in the blue verified check. Since the fake account has the same profile name as the official account, it appears at first glance that the official twitter account just retweeted their own tweet.
Once clicking the link and be directed to https://omisegotoken.com, you arrive at a nearly duplicated site from the original with only one small difference. The fake site has a section specific for the "Airdrop" with a detailed description of how it works and a call to action to claim.
You are then brought to a page and asked to enter in your ETH Wallet Address. The sheer amount of OMG to be received might be another red flag.
The following page then asks for your private key, which is a fundamental thing not to do in the world of the cryptocurrencies and is something that everybody in this space has heard no matter how little or long they have been involved.
Once they have your private key your account will soon be drained. Here is a known account that victim's funds have been funneled into 0x69a862e6f6837c2c4a74f53015e797855441e789. The account has been flagged with reports and yet the scammers continue to funnel more funds into this account every few hours indicating another victim has fallen prey.
Checking into the ICANN WHOIS information of the domain it appears to trace back to Russia.
Unfortunately, many in the space will have to learn some privacy lessons the hard way. Some have little sympathy for those so careless to hand out the private key. The fact is the people engineering these scams are getting better and better. They are able to find subtle ways to build their victims trust.
It's not unreasonable that a middle of the night YouTube binge and a random tweet directs a fellow enthusiast to see what looks like a legit tweet, directs them to what looks like a legit website and explains something like a free airdrop that they might know exists but not really understand. MyEtherWallet has been trusted with private keys so OMG can be trusted too right? Wrong!
The problem is once this specific site and twitter account are taken down more will just crop up. As tokens continue to incentivize and market their projects with things like airdrops it creates opportunities for exploitation especially if these processes are not well understood. Those in charge of these projects should also have some responsibility for eliminating the spread of false information and spoofed sites/accounts. As a community we should be working together to take down these scams quicker.
If you have been a victim of a scam there is little recourse. Educating and advocating other users, reporting spoofed sites/accounts, and filing a FBI Internet Crime Complaint are a couple things that may help shut down the scammers from claiming another victim.