all wallets are scam!
You check your wallets with pywallet tools python pywallet -d -w wallet.dat
You will find the keypool time is incorret.
for example 18NxttmXTJfifBJCeJnJYTVvTniR5hZRBB 75.2 btc
the keypool is:
"pool": [
{
"addr": "1N7nnUeJEmRdUCjUFSgoZSWn6cqNmyPPvc",
"n": 1,
"nTime": 1513148460,
"nVersion": 80500,
"public_key_hex": "029621dc737db8e74cfdb75e94a1ef5f7c266d62a200f97607074a549c943c9241"
},
{
"addr": "1FgTU13mAVJenBLTGeqXQuEj3ZAFEt9q2s",
"n": 2,
"nTime": 1513148460,
"nVersion": 80500,
"public_key_hex": "0231b7eb1c9eb9aaed4bd19759c54120767a0cd1ac07ff65299b59ee5a6294274e"
},
the nTime is modify password time,
I buy this wallet 2017-12-30 the modify password time is 2017-12-13
password is forgot after two weeks, so the wallet.dat is scam
You are wrong nTime parameter is the date when the wallet was encrypted for the first time. When you try to change the passphrase, nTime parameter does not change at all (I tried it on my wallets). It only changes when you have an unencrypted wallet and you decide to encrypt them. Only then does the nTime parameter change for the new date of encryption.