A sophisticated bitcoin (BTC) phishing operation is underway involving a storied Wall Street institution and Mt. Gox.
This week, a Salomon Brothers-branded website began hosting a webform demanding the Mt. Gox-era owner of 79,957 BTC surrender their personal information.
First flagged by BitMEX Research, someone is depositing small amounts of BTC into some of the wealthiest wallets on the Bitcoin network.
Using OP_RETURN outputs to publish a human-readable message to owners of wallets such as 1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF which holds 79,957 BTC worth over $8 billion, someone is asking the owner of that wallet to visit salomonbros[.]com/owner_notice.
That dangerous webpage — which Protos does not recommend visiting — demands that the wallet owner submit personally identifying information. It leads with the text, “This digital wallet appears to be lost or abandoned. Our client has taken constructive possession of it and is [sic] seeks to determine if there is a bona fide owner.”
Constructive possession is a legal term. It’s statutorily defined as “the right to obtain physical control and/or a variety of rights over someone else’s physical control of that property.”
Is salomonbros.com a compromised website?
The demand is curious for multiple reasons, not only for its odd messaging choice — OP_RETURN is at the center of a minor civil war within the Bitcoin community — and confusing webpage citation.
In addition, the 1Feex wallet targeted by the phishing attempt is well-known for stealing its 79,957 BTC trove in March 2011 from Mt. Gox, Mark Karpeles’ failed Japanese BTC exchange.
Finally, the webpage message contains an elementary grammatical error — an unnecessary “is” — which is another red flag.
On February 6, 2022, Bloomberg staff wrote about Salomon Brothers’ revival, citing its website at the time in reference to its advisory board. Bloomberg’s hyperlink, salomonbrothers[.]net/advisory-board, currently attempts to download a file, which Protos declined.
Depending on the browser, attempts to visit the salomonbrothers[.]net homepage, which no longer supports modern HTTPS security, redirect to an intermediary website, salomonencore[.]com, and finally to salomonbros[.]com.
Importantly, Salomon Brothers, which once owned the domain salomonbrothers[.]com, decided to rebrand on March 4, 2022, to Salomon Encore after Citigroup refused to relinquish that domain.
Protos is unable to verify any subsequent rebrand of Salomon Encore back to Salomon Brothers. Although Salomon Encore owned the domain salomonencore[.]com as of March 4, 2022, salomonencore[.]com no longer supports HTTPS and redirects to salomonbros[.]com.
Do not visit suspicious links
Protos has reached out to the owner of salomonbros[.]com and asked them if they are aware of their subpage /owner_notice. We didn’t receive a response prior to publication time.
Read more: DuckDuckGo and Bing users warned of Etherscan phishing website
BitMEX Research is skeptical that salomonbros[.]com is currently controlled by the original company. Protos is unable to determine whether the company owns the domain or its /owner_notice subpage.
The motivation for the demand is similarly unclear and quite dangerous.
If the webpage is inauthentic, any information inputted or used during its access could carry legal ramifications or fuel social engineering or wrench attacks.
As with any suspicious link, Protos doesn’t recommend viewing or visiting any unsolicited webpage.