wqqyfcnm.com scam

A phishing scam involving cryptocurrency was reported against the website wqqyfcnm.com on 15 September 2026. Security research report — not a victim submission. We track an active cryptocurrency wallet-drainer operation known as "pos-coin"/QWDB and are reporting its drain addresses so they can be screened by exchanges and wallet providers. The operation runs a phishing kit presenting a fake "mining pool / staking" platform with fabricated yields and participant counters. Victims are prompted to "apply for a node", which triggers an ERC-20 approve() granting an unlimited (MAX_UINT) or TRC-20 90-trillion token allowance to a drain address. The operator then calls transferFrom() and removes the victim's USDT/USDC. The drain address is not hardcoded in the site. It is returned at runtime by the kit's own unauthenticated API in a field named "authorizedAddress", so one build is redeployed across many domains and the address can be rotated without touching the frontend. We therefore expect new addresses over time and will report them as identified. Scale: 246 domains catalogued since September 2021, grouped into 10 distinct build lineages by JavaScript and CSS asset hash. Every lineage carries the same distinctive developer typo ("BanlancePledge") preserved through minification, establishing a single operator rather than unrelated copycats. Infrastructure is concentrated on Tencent Cloud (AS132203, allocation ACEVILLEPTELTD-SG), with domains registered mainly through Gname and GMO/Onamae.com, plus free-tier Cloudflare Pages deployments. Important note on balances: we checked these addresses on 2026-09-15 via read-only public RPC. All hold a zero USDT balance on Ethereum, BSC and Polygon — this operator sweeps proceeds immediately. We are not claiming recoverable funds. The value of this report is screening and attribution, so the addresses are flagged before the next victim's funds arrive. Victim losses are documented via US FTC complaint 190320519 (USD 8,440.56) and an FBI IC3 filing. Related action in progress: Gname cases GW2026091516343353 and GW2026091516443960 (15 domains), Cloudflare (5 hostnames), Tencent Cloud tickets 10017553191181341 and 10017553451181338, GMO/Onamae (2 domains), and a blacklisting request to Tether. All findings derive from static analysis of served JavaScript, passive infrastructure research, and read-only chain queries. No testing was performed against these hosts and no transactions were initiated. Wallet addresses linked to this report: ethereum: 0x9877a9053DA0d489ebaE46bf2aAe0b9A36f897f9, 0x4dd75e7774245f0afc59509ab8fba7c837de2c4b, 0xf7873Ec3C984D6E04b2004E2Bfd68d42BFe17060, 0xEa664CE9C51a75234fdaf358f190A1a77E5F6fbA, 0x8E301B925a607E7bc91f2A18338bcafb69729698 Do not send money or cryptocurrency to anyone connected to this report. If you have already paid, contact your bank or exchange and report the incident to your national fraud authority.