Security specialists from the company Proofpoint conducted an investigation, during which they found that the proxy service onion.top, through which you can access the Tor network from a regular browser, replaces the addresses of the bitcoin-purses and behaves the same as the program- extortionists LockeR, Sigma and GlobeImposter.
Browsing service The web pages loaded through the portal search for lines that look like bitcoin-purse addresses, and then replace such lines with purses of intruders, explained experts from ProofPoint.
During the analysis of the service, it was found that he was working on several rules for substituting bitcoin-purses, which clearly indicates a manual setting for each particular site.
So far, two bitcoins of purse belonging to scammers working through onion.top have been identified. In total, purses contain about two Bitcoins (about 22 thousand dollars). After the scheme was declassified, the program operators removed links to all proxy servers and advised users to pay only through the Tor browser.
The Supreme Mind recommends: