0

I was a victim of a phishing scheme.

I clicked on a link that was sent to me and got to a site that impersonates a bitcoin site. I entered my credentials and the owner of the site used them to steal bitcoin from my account.

I used whoIs to find out where the website was registered, but that doesn't give me the owner's details.

  • Can I get the website's owner details from the registrar?
  • If so, will I be able to make legal action against them?
  • Will reporting to https://www.us-cert.gov/ help? (are there other places?)
  • 2
    I don't think US-CERT is for investigating petty cybercrime. The FBI would probably be a more responsive agency to contact, I think they even have a whole division for it (ic3.gov/default.aspx). Internet crime is difficult to investigate and prosecute, so good luck! – trognanders Jul 13 '17 at 7:30
  • You could beg their host for billing info. – Nathaniel Suchy Jul 13 '17 at 8:07
  • You need to clarify what sort of phishing scam you just encounter. Because some phishing is run by syndicates that crack in a vulnerable server and host content there. The data might redirect to another Command and control server which is the real culprits. Please describe the details. – mootmoot Jul 13 '17 at 9:52
  • @mootmoot i added some info – Dotan Jul 13 '17 at 12:18
  • 1
    What makes you think that the owner of the website knew anything about the phishing scheme being hosted on it? – Simon B Jul 13 '17 at 12:23
4

Unfortunately, you just encounter a typical phishing page that steal you money and run away.

In most of the scenario, the phishing page is hosted under:

  • Free web hosting
  • hacked website
  • Using dynamic DNS(quite rare)

So site owner might be the victims themselves. Even though you can report this to the authority, but most of the time it is impossible to act, i.e. the command and control center might be shut down within days.

Reported phishing URL show in phishtank show you the similar story, many of them already offline.

Nevertheless, you should also send this phishing URL to sites like phishtank, virustotal, or your antivirus vendors. Because sometimes phishers might recycle/reactivate their command and control center, adding these URL into securities vendor database may stop those URL (if you use those tool) permanently.

0

Using whois.com should give you the owners information. If you cant access them using whois.com, the owner may have hidden the information, an option provided when registering a domain.

  • 1
    This doesn't answer the question. It merely restates part of the question. – Chenmunka Jul 13 '17 at 8:23
0

You personally cannot get the website's owner details from the registrar and, as pointed out earlier, such information often doesn't even exist because of the usual practice of operating phishing websites (free web hosting, hacked websites). The most you can do regarding the legal action is reporting it to the police and provide all the data you have (WHOIS info, screenshots, proxy logs/browsing history). But I wouldn't put much hope in getting any results from it either but it might improve the statistics of cybercrime.

It is certainly not something for US-CERT to investigate as they work on cyberthreats on a bigger scale, not individual attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.