{"id":149477,"date":"2022-04-01T14:35:15","date_gmt":"2022-04-01T21:35:15","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=149477"},"modified":"2025-06-04T03:59:35","modified_gmt":"2025-06-04T10:59:35","slug":"scammers-are-exploiting-ukraine-donations","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/scammers-are-exploiting-ukraine-donations\/","title":{"rendered":"Scammers are Exploiting Ukraine Donations"},"content":{"rendered":"

Authored by Vallabh Chole and Oliver Devane<\/p>\n

Scammers are very quick at reacting to current events, so they can generate ill-gotten gains. It comes as no surprise that they exploited the current events in Ukraine, and when the Ukrainian Twitter account tweeted Bitcoin and Ethereum wallet addresses for donations we knew that scammers would use this as a lure for their victims.<\/p>\n

\"\"<\/p>\n

This blog covers some of the malicious sites and emails McAfee has observed in the past few weeks.<\/p>\n

Crypto wallet donation scams<\/strong><\/h2>\n

A crypto donation scam occurs when perpetrators create phishing websites and emails that contain cryptocurrency wallets asking for donations. We have observed several new domains being created which perform this malicious activity, such as ukrainehelp[.]world and ukrainethereum[.]com.<\/p>\n

Ukrainhelp[.]world<\/h4>\n

Below is a screenshot of Ukrainehelp[.]world, which is a phishing site asking for crypto donations for UNICEF. The website contains the BBC logo and several crypto wallet addresses.<\/p>\n

\"\"<\/p>\n

While investigating this site, we observed that the Ethereum wallet used use was also associated with an older crypto scam site called eth-event20.com. The image below shows the current value of the crypto wallet which is worth $114,000. Interestingly this wallet transfers all its coins to 0xc95eb2aa75260781627e7171c679a490e2240070 which in turn transfers to 0x45fb09468b17d14d2b9952bc9dcb39ee7359e64d. The final wallet currently has 313 ETH which is worth over $850,000. This shows the large sums of money scammers can generate with phishing sites.<\/p>\n

\"\"<\/p>\n

Ukrainethereum[.]com<\/h4>\n

Ukrainethereum[.]com is another crypto scam site, but what makes this one interesting is the features it contains to gain the victim’s confidence in trusting the website such as a fake chatbox and a fake donation verifier.<\/p>\n

\"\"<\/p>\n

<\/h4>\n

Fake Chat<\/h2>\n

\"\"<\/p>\n

The image above shows the chatbox on the left-hand side which displays several messages. At first glance, it would appear as if other users are on the website and talking<\/span>,<\/span> but when you reload the site it shows the same messages. This is due to the chat messages being displayed from a list that is used to populate the website with JavaScript code as shown on the right-hand side.\u00a0<\/span>\u00a0<\/span><\/p>\n

Fake Donation Verifier<\/span><\/i>\u00a0<\/span><\/h4>\n

The site contains a donation checker so the victim can see if their donation was received, as shown below.<\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

\u00a0<\/span><\/p>\n

    \n
  1. The first image on left shows the verification box for donation to check if it is completed or not<\/span>\u00a0<\/span><\/li>\n
  2. Upon clicking \u2018Check\u2019 the victim is shown a message to say the donation was received.\u00a0<\/span>\u00a0<\/span><\/li>\n
  3. What occurs, is upon clicking \u2018Check\u2019 the JavaScript code changes the website code so that it displays the \u2018Thanks!\u2019 message, and no actual check is performed.<\/span>\u00a0<\/span><\/li>\n<\/ol>\n

    Phishing Email<\/span>\u00a0<\/span><\/h2>\n

    The following image shows one of the examples of phish emails we have observed.<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    The email is not addressed to anyone specifically as they are mass-mailed to multiple email addresses. The wallet IDs in the email are not associated with the official Ukraine Twitter and are owned by scammers. As you can see in the image above, they are similar as the first 3 characters are the same. This could lead to some users believing it is legitimate. Therefore, it\u2019s important to check that the wallet address is identical. <\/span>\u00a0<\/span><\/p>\n

    Credit Card Information Stealer<\/span>\u00a0<\/span><\/h4>\n

    This is the most common type of phishing website. The goal of these sites it entices the victim into entering their credit card and personally identifiable information (PII) data by making them believe that the site being visited is official. This section contains details on one such website we have found using Ukraine donations as a lure.\u00a0<\/span>\u00a0<\/span><\/p>\n

    Razonforukrain[.]com<\/span><\/i>\u00a0<\/span><\/h4>\n

    The image below shows the phishing site. The website was used to save the children’s NGO links and images<\/span>,<\/span> which made it appear more genuine. You can see that is it asking the victim to enter their credit card and billing information.\u00a0<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Once the data is entered<\/span>,<\/span> and the victim clicks on \u2018Donate\u2019<\/span>,<\/span> the information will be submitted via the form and will be sent to scammers so they can then use or sell the information.<\/span>\u00a0<\/span><\/p>\n

    We observed that a few days after the website was created, the scammers change the site code so that it became a Mcdonald’s phishing site targeting the Arab Emirates. This was a surprising change in tactics.<\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    The heatmap below shows the detections McAfee has observed around the world for the malicious sites mentioned in this blog.<\/span><\/span>\u00a0<\/span><\/p>\n

    \"\"<\/p>\n

    Conclusion<\/span>\u00a0<\/span><\/h2>\n

    How to identify a phishing email?<\/span>\u00a0<\/span><\/h4>\n