NeilPatel Posted December 30, 2021 ID:1495231 Share Posted December 30, 2021 Hi, for some odd reason when someone goes to FTX.US or FTX.com it is detecting the site as a spam/fake site when it isn't. As you can see from the .mov file it shows it as FTX.cool when the user is not on FTX.cool FTX is a financial exchange. It's a popular brand and the company even has a sporting arena that the NBA team, Miami Heat, plays in, FTX Arena https://en.wikipedia.org/wiki/FTX_Arena (Normally I wouldn't say this, but I am more so trying to show how it is a legitimate site/company) Thanks for your time. 1309879138_ImagefromiOS.mov Link to post Share on other sites More sharing options...
NeilPatel Posted December 30, 2021 Author ID:1495232 Share Posted December 30, 2021 For some reason I can't the video to show up, but if you click around on ftx.us you will see it. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 30, 2021 Root Admin ID:1495236 Share Posted December 30, 2021 (edited) As you can see the block is not from that Domain. That IP address is not registered as any known Domain. This is the FTX.US site with different IP addresses. Maybe there is a bad Ad or other content on the site or in your cache somewhere? Edited December 30, 2021 by AdvancedSetup Updated information Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted December 30, 2021 Root Admin ID:1495237 Share Posted December 30, 2021 Here is another site that shows the block of that IP address Link to post Share on other sites More sharing options...
thisisu Posted December 30, 2021 ID:1495359 Share Posted December 30, 2021 Hi, The block will be removed in the next update. Sorry for the inconvenience Regards Link to post Share on other sites More sharing options...
AOCDELL Posted January 6, 2022 ID:1496328 Share Posted January 6, 2022 Am I missing something here? Look at the certificate. Included in the SAN list is ftx.cool which is DEFINITELY a phishing site. ftx.cool is a mirror image of the genuine site at ftx.com Link to post Share on other sites More sharing options...
AOCDELL Posted January 6, 2022 ID:1496329 Share Posted January 6, 2022 Just now, AOCDELL said: Am I missing something here? Look at the certificate. Included in the SAN list is ftx.cool which is DEFINITELY a phishing site. ftx.cool is a mirror image of the genuine site at ftx.com Yes, the IP 47.57.185.149 returns as Alibaba static address in https://whatismyipaddress.com/ip/47.57.185.149 How about all the ftx.[insert suffix here] addresses? Link to post Share on other sites More sharing options...
AOCDELL Posted January 6, 2022 ID:1496330 Share Posted January 6, 2022 2 minutes ago, AOCDELL said: Yes, the IP 47.57.185.149 returns as Alibaba static address in https://whatismyipaddress.com/ip/47.57.185.149 How about all the ftx.[insert suffix here] addresses? This is the message that is displayed when a user reaches the 'login' popup from any of the fake copies of the real ftx.com site. It is a warning to check that the site being visited is https://ftx.com, and not one of the many fake phishing copycat sites. The mystery to me is how all of these fake versions of the trading platform site can be hailing from Alibaba's static IP address, if it really is an Alibaba address. Link to post Share on other sites More sharing options...
AOCDELL Posted January 6, 2022 ID:1496332 Share Posted January 6, 2022 You can find the IP address of any website by going to a command prompt and typing: ping whateverwebsite.com An example, ftx.soy is returning the same IP address which is reported at https://whatismyipaddress.com/ip/47.57.185.149 as coming from AliBaba. In my opinion it seems clear that Malware Bytes should be blocking access to the IP If I am missing something obvious then please explain. Link to post Share on other sites More sharing options...
AOCDELL Posted January 6, 2022 ID:1496333 Share Posted January 6, 2022 The real alibaba.com ping shows NOT the IP 47.57.185.149 which the fake ftx sites are associated with. See ping results in image below. Link to post Share on other sites More sharing options...
thisisu Posted January 6, 2022 ID:1496397 Share Posted January 6, 2022 Hello, After additional research, we will continue blocking ftx.cool and the IP address 47.57.185.149 Sorry for the confusion here. Regards Link to post Share on other sites More sharing options...
thisisu Posted January 6, 2022 ID:1496406 Share Posted January 6, 2022 12 hours ago, AOCDELL said: Am I missing something here? Look at the certificate. Included in the SAN list is ftx.cool which is DEFINITELY a phishing site. ftx.cool is a mirror image of the genuine site at ftx.com Hi, I was unable to reproduce what you displayed here regarding the certificate used. Did they change the certificate? I see this: Link to post Share on other sites More sharing options...
NeilPatel Posted January 6, 2022 Author ID:1496407 Share Posted January 6, 2022 The Ftx.cool site is ours as well. We have different domains, but that one is valid too. 1 Link to post Share on other sites More sharing options...
NeilPatel Posted January 6, 2022 Author ID:1496411 Share Posted January 6, 2022 What we are trying to do is not get the virus/warning message to show up as the sites are valid. Link to post Share on other sites More sharing options...
AOCDELL Posted January 6, 2022 ID:1496448 Share Posted January 6, 2022 Here are screenshots of the user login pages for each of ftx.digital ftx.cool ftx.blue ftx.page ftx.soy test.ftx.digital & the page for 47.57.185.149 Group A: This group consists of ftx.blue, ftx.digital, & ftx.cool Group B: This group consists of ftx.page, ftx.soy, & test.ftx.digital Group A sites each inform the user to check whether they are visiting either ftx.com OR ftx.[insert suffix displayed in the address bar] (images below) Group B sites each inform the user to check whether they are visiting ftx.com ONLY. For group B sites, the domain name in the address bar does not match with that which is suggested to confirm against (ftx.com). (images below) Finally, for 47.57.185.149 So, from this observation alone it would appear that the Group A domains are 'real' FTX sites, and the Group B domains are not. ----- NB: I received a message from ftx.com today declaring that ftx.cool is indeed a genuine FTX site, and is not a phishing site. ----- OK. So what else? How about the IP addresses for all of these sites? I pinged them. The results can be found below. Group A ftx.digital & ftx.cool share the IP 47.57.185.149 while ftx.blue returns a value of 8.210.131.114 Group B All Group B sites share the IP 47.57.185.149 (and it can be seen that when pinging test.ftx.digital - the command line drops the 'test' part of the command, leaving behind only ftx.digital) For good measure I also pinged alibaba.com, ftx.com, & ftx.us by the same method. Each IP address in this final set of three sites can be seen to be unique to its own domain name. Domains returning the IP address of 47.57.185.149, (which, to remind, when entered into Chrome as the digits, shows the following warning message) include the following domains: ftx.digital, ftx.cool, ftx.page, ftx.soy, & test.ftx.digital, [these are all on this 47.57.185.149] ----- Strange however is that both ftx.cool & ftx.digital are from Group A, (the group whose login screens give a choice of two 'genuine urls' to cross reference against the address bar.) Based on this data alone, it is not possible to make a statement as to whether a 47.57.185.149 domain will offer one, or two, 'genuine urls' to cross reference against the address bar. Similarly, it is not possible to state whether a domain which gives two 'genuine urls' at its login page to cross reference against the address bar will have the IP 47.57.185.149 One thing that IS known however is that all of ftx.digital ftx.cool ftx.blue ftx.page ftx.soy test.ftx.digital & 47.57.185.149 ARE seen within the same certificate today, Jan 7th 2022. What does it all actually mean? Does it mean nothing at all? Which (if any) of ftx.digital ftx.cool ftx.blue ftx.page ftx.soy test.ftx.digital & 47.57.185.149 are phishing sites? NB: I received a message from ftx.com today via https://ftx.com/support/ declaring that ftx.cool is indeed a genuine FTX site, and is not a phishing site. For future investigation perhaps: 1. What are the implications (if any) of a certificate not complying with Chrome's transparency policy? What does this mean exactly? 2. Is offering the same service to users by multiple domain names a common practice in this industry? If yes, then no red flags here. 3. Which (if any) of the sites are fake/phishing? Difficult to test, since smaller accounts would likely not draw attention, and testing with larger accounts would be an expensive experiment! Possibly the sites at domains which do not match the name which the login screen reminds the user to cross reference against. So that would be ftx.soy, ftx.page, & test.digital.com. But that does not explain why ftx.digital & ftx.cool share the same IP as soy, page, & test.digital. What a puzzle! ----------------------------------------------------------------------------------------------------------- Link to post Share on other sites More sharing options...
AOCDELL Posted January 7, 2022 ID:1496485 Share Posted January 7, 2022 23 hours ago, AOCDELL said: Am I missing something here? Look at the certificate. Included in the SAN list is ftx.cool which is DEFINITELY a phishing site. ftx.cool is a mirror image of the genuine site at ftx.com *** I received a message from FTX support team - ftx.cool is NOT a phishing site *** *** no comment made about the other ftx.[other] domains *** Link to post Share on other sites More sharing options...
AOCDELL Posted January 8, 2022 ID:1496695 Share Posted January 8, 2022 On 1/7/2022 at 2:45 AM, NeilPatel said: What we are trying to do is not get the virus/warning message to show up as the sites are valid. Who is "we"? Do you represent FTX Digital Markets LTD in an official capacity? If so, are you able and willing to make an official statement here as to which (if any) of ftx.digital ftx.cool ftx.blue ftx.page ftx.soy test.ftx.digital or 47.57.185.149 are in no way connected to FTX Digital Markets LTD? Transparency is without doubt the best ally for any legal entity or individual that wishes to avoid any doubts as to their integrity. Link to post Share on other sites More sharing options...
AOCDELL Posted January 8, 2022 ID:1496699 Share Posted January 8, 2022 49 minutes ago, AOCDELL said: Who is "we"? Do you represent FTX Digital Markets LTD in an official capacity? If so, are you able and willing to make an official statement here as to which (if any) of ftx.digital ftx.cool ftx.blue ftx.page ftx.soy test.ftx.digital or 47.57.185.149 are in no way connected to FTX Digital Markets LTD? Transparency is without doubt the best ally for any legal entity or individual that wishes to avoid any doubts as to their integrity. Although that message could be interpreted as hostile in terms of its tone, it is not intended to. It will be a manifestation of the frustration felt after four weeks of relentless and as yet fruitless investigation into my own family's life-changing financial loss due to cyber crime. Link to post Share on other sites More sharing options...
NeilPatel Posted January 8, 2022 Author ID:1496718 Share Posted January 8, 2022 I represent the company in an official capacity and work there. My email is neil.patel@ftx.com (which I created this account from). 1 Link to post Share on other sites More sharing options...
AOCDELL Posted January 9, 2022 ID:1496799 Share Posted January 9, 2022 (edited) 17 hours ago, NeilPatel said: I represent the company in an official capacity and work there. My email is neil.patel@ftx.com (which I created this account from). My time resource allocation for investigating this ftx.digital ftx.cool ftx.blue ftx.page ftx.soy test.ftx.digital or 47.57.185.149 conundrum is now exhausted. I thought that it could be a lead worth following to help resolve case #283803 (FTX.com support ticket), but I'm now satisfied that the sites listed were not part of whatever string of events enabled "my" attacker to gain access to my FTX.com trading account. There are only a limited number of ways to bypass google 2FA, which is what the hacker managed to do in my case. That hackers can manage to do this is extremely concerning. Here is one method by which hackers can circumvent authenticator apps (stealing session cookies): It is good that FTX.com now offer authentication by YubiKey. This will prevent account wipe-outs for customers in the future. Wish you best of luck in cleaning up your IP address/cloned sites dilemma. James Edited January 9, 2022 by AdvancedSetup Corrected font issue Link to post Share on other sites More sharing options...
AOCDELL Posted January 9, 2022 ID:1496802 Share Posted January 9, 2022 Final post: https://therecord.media/more-than-1200-phishing-toolkits-capable-of-intercepting-2fa-detected-in-the-wild/ This details the method(s) by which cybercriminals can bypass 2FA by stealing the session cookie from the website. Seems that even Yubikeys cannot prevent these kinds of attack, since a session cookie would be present regardless of the login process. ----------------------------------------- Link to post Share on other sites More sharing options...
Porthos Posted January 10, 2022 ID:1496882 Share Posted January 10, 2022 @NeilPatel I suggest waiting until staff member @thisisu returns to the topic to respond. 1 Link to post Share on other sites More sharing options...
thisisu Posted January 10, 2022 ID:1496971 Share Posted January 10, 2022 Thanks for all the information everyone. We've reached out via the support page on ftx.us and will act accordingly based on their response. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now