I have recently been made aware of a large scale crypto scam falsely using the name of a legitimate company called Phiture (Phiture GmbH).
The fraud is quite simple but the people behind this look to play the long term game until you have no more funds to deposit into the account.
How they contact you
You will be contacted on a mobile app which has mainly been WhatsApp so far from a wide range of numbers, the person who will initially contact you will advise they are from a recruiting agency but infact are not. They are using legitimate recruiting agencies names, if you decide to google the names to check reviews they look entirely legitimate but after contacting these agencies it is confirmed they are fake.
What happens when they contact you?
You will receive a chat similar to the one below
You will soon then be contacted by “another” person claiming to be the manager who will provide you with training for the work they are offering. The training will consist of them providing you a username and password to sign into a website, the name will normally contain the word “phiture” at some part. Once you have completed the training you will be asked to create an account using a provided referral number.
You will then be asked to proceed with the first 40 tasks on your account by adding 100 USDT from your crypto wallet into your account, once you complete these tasks you will be able to withdraw your earnings and initial 100 USDT, this is normally around 130 USDT.
You will be asked to complete this process twice a day for 5 days, depositing and withdrawing each time which they will pay you. On the 5th day you will receive your salary on to your account with them, when you attempt to proceed to do your daily tasks you will be hit with something they like to call a combination task which will leave you a negative balance on your account with them, they will advise you to deposit the needed amount to complete the daily tasks if you do deposit this to bring the account balance back to zero within the next few tasks you will then receive another combination task with a larger negative amount which they request you deposit. If you refuse and simply request your funds and salary you are blocked from the WhatsApp contact and your account is frozen on their website for not “following” their terms of service.
Known Information
Phone Numbers
CS1 – 07935 654387 – O2
CS2 – 07366 090503 – Three
CS3 – 07706 843114 O2
Sadie – 07935 222402 – O2
Zara – 07846 690357 – Three
Abraham – 07310 974593 – Three
Jeremy – 07367 824101 – Three
Unknown – 07861 734469 – Three
Sally – 07413 145529 – Three
Many of these above numbers have been reported to these service providers and since suspended
DNS Server Information used by all domains
dnsenum uk-phiture.com
dnsenum VERSION:1.2.6
—– uk-phiture.com —–
Host’s addresses:
viph.gf.gncdn.cloud. 60 IN A 3.8.132.13
viph.gf.gncdn.cloud. 60 IN A 18.135.140.171
Name Servers:
ns2.dns.com. 902 IN A 211.99.99.33
ns2.dns.com. 902 IN A 183.253.57.193
ns1.dns.com. 3381 IN A 218.98.111.202
Mail (MX) Servers:
Trying Zone Transfers and getting Bind Versions:
Trying Zone Transfer for uk-phiture.com on ns2.dns.com …
AXFR record query failed: timed out
Trying Zone Transfer for uk-phiture.com on ns1.dns.com …
AXFR record query failed: timed out
Brute forcing with /usr/share/dnsenum/dns.txt:
www.uk-phiture.com. 300 IN CNAME dltch.cdn.gncdn.cloud.
dltch.cdn.gncdn.cloud. 60 IN CNAME viph.gf.gncdn.cloud.
viph.gf.gncdn.cloud. 60 IN A 3.8.132.13
viph.gf.gncdn.cloud. 60 IN A 18.135.140.171
uk-phiture.com class C netranges:
Performing reverse lookup on 0 ip addresses:
0 results out of 0 IP addresses.
uk-phiture.com ip blocks:
done.
Domain Names
uk-phiture.net – This domain was being used for the admin control panel at admin.uk-phiture.net
uk-phiture.com – Original domain name of the scam website. (Domain Suspended)
19/01/23 – Domain Suspension Request made by me to Name.com
uk-phiture-revue.com
phiture-survey.com
uk-phiture-aka.com
uk-phiture-audit.com
Above domains are currently pending suspension
20/01/23 – Domain Suspension Request made by me to Name.com
uk-phiture-program.com
The above domain is currently pending suspension
How the scammers are turning the crypto to money
I have tracked a number of the crypto wallet’s used by the scammers, one has contained around $130,000 USDT and all funds that have been taken from people are used to obtain electrical devices (mobile phones) on a China based exchange which are then sold online for 85-90% of the true value to turn their crypto into useable funds.
(Screenshots to follow soon)
I have sent a postal letter to Phiture Germany head office using tracked and recorded mail which was delivered to their office on 11/1/23 and have had little to no follow-up from them.
Phiture has employed a company called Make IT Fix to take action and close these scam websites down, I have provided much of my research to them up to this point.
I have first hand experience of this scam and unfortunately lost quite a bit of money to them.
The numbers are still active and I like to send them nasty messages every now and then.
If you want, I have some wallet addresses they used which may help in tracking them down perhaps?
There is another site dedicated to exposing this scam ( https://www.uk-phiture-fraud.com/ ) and this guy has some good records and pics concerning this scam and the process involved
Thanks for highlighting this issue. I had recently fallen victim to this and lost money. At the time of them researching out, I had done some due diligence Googling and making sure it wasn’t a scam and couldn’t find anything online. I am still in contact with them and trying to figure out how to take them down.
Hi I have been scammed by them how can I get my money back or is it lost
I’d like to report this agent
Goes by Lisa
Her contacts are +61 483 919 442 and +61 483 918 553, the website is https://www.theasoproject-service.com/#/pages/user/user
This seems to be operating in HK too. But basically it means as long as you are not greedy and just take the small amount profits at the start and never deposit a lot of money you can’t lose money? I was worried they were using my bank account number to steal from later. Is that a genuine possibility? 🙏
Just beware of another site to add to the list. They are now pretending to be Cineworld:
https://www.cineworlduk.vip
Did you work for the cineworld one? What happened?
Nice blog here! Also your web site loads up fast! What host are you using? Can I get your affiliate link to your host? I wish my site loaded up as fast as yours lol
Yes, our blog uses web hosting provided by https://vps.mr
Thank you for your articles. I find them very helpful. Could you help me with something?