<h2 id="header-0">Background</h2>Recently, a new phishing scam has caught our attention. This scam typically occurs in chat applications like Telegram, beginning with off-exchange transactions. Before the actual transaction, the scammer asks the victim to transfer a small amount, say 0.1 USDT, to verify if their address poses any risks. The scammer then sends a so-called “public chain” address for the transfer, emphasizing that it must be entered in the wallet browser for the transaction to proceed. Unfortunately, once the victim enters this “public chain” address in their browser, they discover that all tokens in their account have been stolen.<img src="https://miro.medium.com/v2/resize:fit:700/0*nl1jhuBSVr2anpAy" />So what exactly happened?<h2 id="header-1">Analysis of the Scam</h2>Upon analyzing the information provided by the victims, we discovered that this is not a case of simple transfer theft. Note: Addresses have been obscured to protect the victims’ information.<img src="https://miro.medium.com/v2/resize:fit:700/0*U17xhX0raCFMEZkk" />Based on our experience, this appears to be a phishing theft caused by authorization. The contract caller (TK…Gh) transferred 271,739 USDT from the victim’s address (TX…1W) to the scammer’s address (TR…8v) by invoking the transferFrom function.At this point, we focused on the “public chain” address mentioned by the scammer: 0x2e16edc742de42c2d3425ef249045c5c.in<img src="https://miro.medium.com/v2/resize:fit:700/0*7Na_fV6j7lWC8WZ7" />At first glance, the address seems unproblematic. But a closer look reveals significant issues! First, the transfer occurred on TRON, but this is an address starting with 0x; secondly, upon further inspection, it turns out that this is not an address but a website ending with .in.Upon analyzing this website, we found that it was created a month ago (October 11th) with the associated IP being 38.91.117.26:<img src="https://miro.medium.com/v2/resize:fit:700/0*10B5YkWzy1YNQ4RC" />Similar websites exist under this IP, all created within the last month:0x2e16edc742de42c2d3425ef249045c5b.inTgsfjt8m2jfljvbrn6apu8zj4j9ak7erad.in<img src="https://miro.medium.com/v2/resize:fit:700/0*hgGTJUcoRz2ocN9m" />Currently, only 0x2e16edc742de42c2d3425ef249045c5b.in is accessible. When searched in a wallet browser, this page only allows the selection of the TRON network.<img src="https://miro.medium.com/v2/resize:fit:700/0*jz9ZkXVjy8LMDgzE" />After entering an amount and clicking next, it shows as a contract interaction.<img src="https://miro.medium.com/v2/resize:fit:649/0*d4g8qQu2hwIl0S7g" />We decoded the data in the Data section and found that the scammer (TYiMfUXA9JcJEaiZmn7ns2giJKmToCEK2N) lures users into signing an increaseApproval. Once the user clicks Confirm, their tokens can be stolen by the scammer using the transferFrom method.<img src="https://miro.medium.com/v2/resize:fit:700/0*4NNeRLVV-LXh776q" />An analysis of this scammer’s address reveals that users have already been tricked.<img src="https://miro.medium.com/v2/resize:fit:700/0*-zlbZKXaz4t0Ludq" />Most of the victim’s USDT was transferred to the address TLdHGHB8HDtPeUXPxiwU6bed6wQEH25ZKQ.<img src="https://miro.medium.com/v2/resize:fit:700/0*kzGNH_dO4OgeeT10" />Using MistTrack to check this address, we found it received over 3,827 USDT.<img src="https://miro.medium.com/v2/resize:fit:700/0*fbzmZxZK4Cgfc0EH" />Further analysis of other addresses is not discussed in detail.<h2 id="header-2">Summary</h2>This article starts with an actual theft case and introduces a new type of scam that disguises phishing websites as transfer addresses. SlowMist Security Team reminds everyone that since blockchain technology is immutable and on-chain operations are irreversible, it is crucial to carefully verify addresses before any operation. Understanding the risk profile of the target address, such as checking its risk score and malicious tags on MistTrack, is essential to avoid financial losses. If you notice any unusual transactions on an address, be vigilant, and calmly check. If needed, contact us or submit a form at <a href="https://aml.slowmist.com/recovery-funds.html" rel="noopener noreferrer nofollow">https://aml.slowmist.com/recovery-funds.html</a> for assistance.<h3 id="about-slowmist">About SlowMist</h3>At SlowMist, we pride ourselves on being a frontrunner in blockchain security, dedicating years to mastering threat intelligence. Our expertise is grounded in providing comprehensive security audits and advanced anti-money laundering tracking to a diverse clientele. We’ve established a robust network for threat intelligence collaboration, positioning ourselves as a key player in the global blockchain security landscape. We offer tailor-made security solutions that span from identifying threats to implementing effective defense mechanisms. This holistic approach has garnered the trust of numerous leading and recognized projects worldwide, including names like Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, and Cheers UP. Our mission is to ensure the blockchain ecosystem is not only innovative but also secure and reliable.SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. They offer AML (Anti-money laundering) software, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. They have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.By delivering a comprehensive security solution customized to individual projects, they can identify risks and prevent them from occurring. Their team was able to find and publish several high-risk blockchain security flaws. By doing so, they could spread awareness and raise the security standards in the blockchain ecosystem.&#x1f4ac;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">Website</a> &#x1f426;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">Twitter </a>⌨️<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">GitHub</a>

New Scam Alert: Beware of Phishing URLs Disguised as Transfer Addresses

Table of Contents

SlowMist

Other articles published on Nov 15, 2023

Record single-day liquidation of $300M as Bitcoin slipped under $35K

Bithumb records declining performance in Q3 amid market challenges and interest rate hikes

CME Surpasses Binance to Claim Dominance in Bitcoin Futures Trading

FTX and BlockFi claims settlement moves forward

Shark Tank star Keven O’Leary Reveals M2 a New Player in Crypto to Challenge Binance

Commerzbank becomes first major German bank to obtain cryptocurrency custody license

Join our free newsletter for daily crypto updates!