Starts with an email sent through Google Forms. It includes the email address and a link that goes through Google and redirects to audiosales.ru (redacted because there is a tracking link embedded that may link to my real email). Audiosales.ru shows you this “safety” popup:
Impersonating Norton
Then it redirects you to btcbonus.in:
Clicking through brings you to this login page, with the user name and password helpfully already filled in:
I have to say the next page is very well done, a screenshot wouldn’t work because there is too much activity, but it starts “counting up” your bitcoins that you’ve mined, and there is a fake shoutbox with “users” chatting. It does take an awful long time to count up all your earning though, but according to the script you have been gone 364 days 
Finally it finished counting, and I have over $22k in bitcoin to collect! Oh but look, a good chunk of the transactions have not been confirmed. Will that be a problem? Let’s find out
And now we are having a fake chat with “Amelia”
Now I have to fill out an application to make the withdrawal. Hmm, seems kinda light on necessary details, guess KYC isn’t a problem here
Put in some crap, lets see if it works. It goes back to the chat with Amelia, now she has confirmed I will receive $22,625.98, but I need to exchange the bitcoin first with Binance. And here’s where the scam hits: you need to pay $64 for the transfer fee. It redirects you to btcpayment.cc but it identifies itself as MoonPay.com. It asks for your name and phone number, then redirects you to cryptosavepro.tech, which provides the address to send $64 in bitcoin to.
Obviously I’m not going to do that so that ends this scam trail.
Identified Domains:
audiosales.ru
btcbonus.in
btcpayment.cc
cryptosavepro.tech
Email Body:
Thanks for filling out 
Your account:“CC-222138991” will be blocked!
Here’s what was received.
Your account:“CC-222138991” will be blocked!
Hello, Dear!
364 days ago, you registered on our platform for automatic cloud Bitcoin mining (collecting)by linking your devices to our platform by IP address.
You were not active in your personal account, but the collection of cryptocurrency occurred automatically from your device.
Your account:“XE-6862222982” will be blocked after 24 hours. Please, withdraw the remaining funds within 24 hours!
Sincerely, Finance Department.
P/S: Details in your personal account: REDACTED
Email *
REDACTED
