@BlockmageSec

Web3 Native Threat Intelligence.

 The Ether
blockmage.dev
Joined December 2022
  • Tweets268
  • Following151
  • Followers1.3K
Ironically this was not created for this occasion, just something that was coincidentally lying around.
1
1
1,068
We now have ~97 of those addresses @tayvano_ posted tracked on both @ArkhamIntel and @blocknative for a few of the EVM chains just to double-up on alerts. If you any of you guys who are using @AtomicWallet that have been affected could, please post your TX hashes/wallet address!
Tay 💖
@tayvano_3 Jun 2023
Atomic Wallet people you need to post your addresses and transaction hashes if there’s any hope of anyone determining scope and scale. As we’ve learned from past incidents, you cannot and should not rely on the wallet that just rekt you to determine jack shit.
2
3
2
13
2,763
"Phishing: PinkDrainer: Contract 1" etherscan.io/address/0x00000… @zachxbt It seems like pink here, who is also known as: blockdev / chainwatcher / chainthreats by the way - and dw we have more on him too - but, evidently, he has a crush on you. I guess he needs the attention. 🙄
2
3
9
2,576
Check the internal transactions for a cleaner overview. We can see the yet-unlabeled address with a proper label here, thanks to the @MetaDockTeam / @BlockSecTeam having labeled the it already in their systems, which makes it visible to us through the MetaDock browser addon.
1
1
4
3,108
0x439817104135AD555AEe48e38BbE62452906D26D NotYetFlagged - imsokawaii.eth 0x3aDcFC546bccb3a4a2530b7eEB1CBC07d08fC60C NotYetFlagged - hop, usdt, offtherip.eth (md-seenotes4) 0x1751DC0e23B76B06D47309BF745f4b5e1B281DF2 NotYetFlagged - another hop, offtherip.eth (md-seenotes2)
2
243
0x98352EC844dE71fBab32defa310FeC036a25013b seen in the far top of this chart is either someone with a bad gambling problem, or an obvious laundry attempt using Bovada casino + Stake[.]com. Or both? (Phished account repurposed?) 500+ days of "gambling" history. Hmm.
1
229
0xfcA28D26D24EBDDAD88b073cd1FD28966Fa910A5 NotYetFlagged - [no ens] 0x84527B5949D479c879b8Dd71cd8f79048CdF6fB8 FPhish7064 - federalagent👮‍♂.eth 0x98352EC844dE71fBab32defa310FeC036a25013b NotYetFlagged - (md-seenotes3) <- internal label ignore lol [0x9835] is interesting:
1
200
metasleuth.io/result/eth/0xc… <-- full chart, poke at it, modify it, whatever you want. Thanks @MetaSleuth Addresses: 0x1BA383587E6B6e8925bC2fFF5D6165aB8A2EeAAF FPhish11227 - [no ens] 0xc05ff14a15d271c4866e8d9f6e05499042Ed17fF NotYetFlagged - offtherip.eth No particular order*
1
195
@Namecheap was INSANELY fast about taking the fake site offline. Seriously, what the... that was freaking cool! The site remained cached in the CDN for a little while after, but it wasn't long before the phishing site became a lovely shade of www-dot/CGI-BIN-LOL-NOTTODAY-gray:
A screenshot of an error webpage displaying the text "Account Suspended," in place of the scam website, after being taken offline by the registrar. It was an extremely fast and impressive response by Namecheap, the registrar through which the attacker happened to purchase this domain.

ALT A screenshot of an error webpage displaying the text "Account Suspended," in place of the scam website, after being taken offline by the registrar. It was an extremely fast and impressive response by Namecheap, the registrar through which the attacker happened to purchase this domain.

1
133
Who likes charts!? #metasleuth is out here kicking ass with the chart tools. Check them out if you like what you see throughout. (The official account is @MetaSleuth) We will zoom in but here's an overview of some recent #monkeydrainer activity
1
398
Load more