mrluit / etherscamdb Goto Github PK
View Code? Open in Web Editor NEWKeep track of all current ethereum scams in a large database
License: MIT License
Keep track of all current ethereum scams in a large database
License: MIT License
Better to show some background status if it's by maintenance reason.
Search should be case insensitive for domain names, e.g. MyEnthereumWallet.com should return the same result as myenthereumwallet.com
Just an incident report, on both chrome and firefox.
https://etherscamdb.info/address/0x5208d7f63A089906889A5A9CAed81E9C889E64F8
It's not an issue, but I want the address pages showing the total transfer-in Ether amount instead of USD (not required, out of the scope of your site)
By the total-in and balance, we can better understand the behavior.
Etherplorer has an API returning it. They gave me an api key for me referring some analysis around ESDB.
Please whitelist our Twitter account @Locanza_org
Thanks a lot!
Since the release of #21 the style for the icons wasn't overwritten from the cached copy on the browser.
POA: Put a query string of the date/version on the JS and CSS. Ie: <link rel="stylesheet" href="/css/general.css?version=1504005602">
https://etherscamdb.info/scam/77/ - Fake mew
has
https://etherscan.io/token/0x5af2be193a6abca9c8817001f45744777db30756
which not likely be connected with a particular scamming of this fake site, but ETHOS token contract.
Search "ETHPAYS.ME" and "ethpays.me" did show a different result.
Further more, input character case handling and others have to be carefully examined in the process pipeline upon variation of search string such like with or without "http://", trailing slach char etc. , in order to avoid false negative/positive result for users manually accessing it.
Scams list will be much attractive to be sorted by lines with status category, active lines group on top as default.
Optionally, having sorted and unsorted switch by clicking the column title, and other titles also.
Copy of MetaMask/eth-phishing-detect#794
Hi, please add to black list this address:
0x9eb041AF96d44583110565ABeC79aedf22Eb60b5
It's using in fake AirDrop of Nucleus Vision (proof https://docs.google.com/forms/d/e/1FAIpQLSeRw1qALR7-rbvOKRM-Wgs1TxmAN5BC7_XzATFiHIVRuRlegQ/viewform). There was no official anouncments nor at the website https://nucleus.vision or twitter https://twitter.com/NucleusVision
_data/scams.yaml
Is getting too large. Make them easier to handle by splitting them into smaller files.
Break up scams.yaml
into smaller _data/scam files (a good way to do this would be to parse through each scam and create individual files for each category). Test to see if it makes more sense to do this by category or subcategory.
Create a method that concatenates them on run and update. Verify that this does not conflict with existing functionality
There is no reason to really contact a third-party host to send the report off to where it needs to go, especially as it just entails a cURL request to the endpoint (where we handle the reports).
Create a new config item for the slack webhook token and redo the report to send the report directly to a Slack channel.
Something is off with lines https://github.com/MrLuit/EtherScamDB/blob/master/run.js#L443 and https://github.com/MrLuit/EtherScamDB/blob/master/_layouts/address.html#L8 as the {{ address.address }}
doesn't replace.
Example: https://etherscamdb.info/address/0xe4fa5149306b12d51dc0d04e5e95bc9704ccaad7/
<div class="ui body container">
<link rel="stylesheet" href="/css/address.css">
<h1>0xe4fa5149306b12d51dc0d04e5e95bc9704ccaad7</h1>
<div class="ui mini red message"><i class="warning sign icon"></i> Warning: Do not send money to this address</div>
<b>Balance</b>: <span id="balance">0 ETH</span><br>
<b>USD Value</b>: <span id="value">0$ (745.14 USD/ETH)</span><br>
<b>Related to the following scams</b>: <div class="ui bulleted list"><div class="item"><a href="/scam/2135/">OmiseGO.com</a></div></div><a href="/scam/2135/">
<div class="ui divider"></div>
</a><a target="_blank" href="https://etherscan.io/address/{{ address.address }}"><i class="external icon"></i> View address on etherscan</a><br>
We need to enable CORS so that people can consume the JSON files with Javascript (specifically EtherGraphs.com is having an issue with pulling in the data with AJAX)
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
We need to set a header Access-Control-Allow-Origin: *
.
Assigning to you Luit because it might be easier to enable it in the server config.
On report page, change the red "no" button to read "No - I want to report an address / website"
On layer two of "i'm not sure":
On forms that are more than one step, add back button (if possible)
Update any buttons that don't give the user a more clear idea of what clicking the button will do
On finishing pages (Thanks for your Report
) add a third line of copy educating users about security:
Add these HW wallet affiliate links to the footer as well.
Add buttons or make the entire square on homepage a link to Github, Report, Etc.
Add square for hardware wallet stuff w/ affiliate links
Under knowledge, link to simple links page that just has valuable resources for people. Things like the links I provided above, any reddit threads you find in the future that are useful, etc. You can find some good resources here: https://myetherwallet.groovehq.com/knowledge_base/topics/resources-for-diving-deeper
The PHP script for Slack needs upgrading. Lots of reports are hard to read.
ABUSEIPID seems to be well accepted malicious IP repository widely utilized at internet security community.
Showing Either or both by a summary and/or link to its IP page as a cross reference will be efficient.
https://www.abuseipdb.com/check/162.144.51.201
https://etherscamdb.info/ip/142.4.26.221
Edit Search tab to allow for 0x Address searching
Web server appears down
In my opinion it should be case insensitive.
Example:
https://etherscamdb.info/api/check/0x92d43d2f55e077d1bebc6e348a9f4ff64fd4f21a/
returns
{"success":true,"result":"neutral","type":"address","entries":{}}
https://etherscamdb.info/api/check/0x92d43D2f55E077D1beBC6e348a9F4FF64fD4F21A
returns
{"success":true,"result":"blocked","type":"address","entries":[{"id":4056,"name":"blttrex.us","url":"https://blttrex.us","category":"Trust-Trading","description":"Trust-Trading site","addresses":["0x92d43D2f55E077D1beBC6e348a9F4FF64fD4F21A"],"ip":"198.252.108.77","nameservers":["ns10.hawkhost.com","ns9.hawkhost.com"],"status":"Active"}]}
The website reports the address as a scam, regardless what case is used:
https://etherscamdb.info/address/0x92d43d2f55e077d1bebc6e348a9f4ff64fd4f21a/
Regarding ethereum-gift.website,
https://twitter.com/TheRealLeo/status/1015177418791968768
https://urlscan.io/result/9d31eca7-235a-45ee-9189-af140c8fc5c9
https://etherscan.io/address/0x52b949fb4678c20873135ce6b3727949432af1d7
https://www.phishtank.com/phish_detail.php?phish_id=5716610
https://www.virustotal.com/url/154381ea773053e97339a034b1bbf87a90c9d8a9940695cdd350d8c6597425ef/analysis/1530922094/
https://www.virustotal.com/url/7ecb632ceac25bc9d75b28d3de6b656bea5e0474a4b13b93bf3339e9b7edc952/analysis/1530922098/
Here's all what I do for a fresh scam, other than reporting google safe browser and reporting it to twitter
By chance, Let's talk about some tool. Seki
ReCaptcha is not displaying on the Report screen, or is failing, after trying to report a domain:
Further info: Win 10 + Chrome Version 65.0.3325.181 (Official Build) (64-bit)
Note: This issue does not occur in IE, Edge, or Firefox.
To reproduce:
I want to be verified as i am contributing to Cryptocurrency valid airdrop. Always do makesure to verify website and etheraddress via Etheraddresslookup.
Below three fake mew domains are blocked now but ESDB is showing them as "not blocked"
I guess Google hesitate to show the real status online by several reasons,
or they kindly showing the real site status to infosec services.
https://etherscamdb.info/scam/4635
https://etherscamdb.info/scam/4636
https://etherscamdb.info/scam/4638
Recent scams e.g. tron-online.org https://etherscamdb.info/scam/2949 are not showing correct MetaMask status on the website.
Scams are included in eth-phishing-detect e.g. tron-online.org is in https://github.com/MetaMask/eth-phishing-detect/blob/master/src/config.json
I assume that EtherScamDB is using the npm released version. Last npm release of eth-phishing-detect was 1.1.12, 5 months ago. https://www.npmjs.com/package/eth-phishing-detect
At https://etherscamdb.info/report a styling error occurs where there is overlapping texts. This does not occur in Chrome or IE.
www.blocklist.de is doing that well.
https://www.abuseipdb.com/check/125.109.194.241
Hi @MrLuit I am a graphics designer and open source enthusiast. I want to contribute to your good project by proposing a logo design for the project for added visibility.I have noticed it doesn't have one yet. I will be doing it as a gift for free. I need your permission before i start my design. Thanks and best regards
Currently there is no indication of a new search being conducted on the ui.
One way to do this is to add the searched name to the existing notification that pops up.
Another way to do this is to add a new section that displays when the search button is clicked below the search input field containing the name being searched.
Virustotal is an open service that aggregates scanning upon signature in files, addresses, and names by independent providers, both in private and open environment. Its open URL/domain scanning shows good cross-reference between legacy security community and Ethereum, as well as pushing awareness about Ethereum blockchain space for private users of it mostly in the legacy security community.
Current ESD SCAM domains are mostly scanned there publicly already on both http and https, and scanning result records are kept there with "positives" number, showing the number of services detected SCAM among sixty or so. Newly added ESD records are done in a day.
Scanning newly added ESD domain are mostly first-time public scan there but in case it was active at phishing, already scanned with positives. So scanning ESD SCAM domain makes an extension of it at Virustotal in some sense.
Assuming above sniff benchmarking, following changes are recommended
These might be an affordable subset of ESD expansion.
I've using spreadsheets now as workbench and trying to move into Jupyter or some other for prototyping.
Hello there, could you please add a license. Prefer not to assume it's MIT
Phishtank can be used to verify the current status of a scam site with a chance to vote, while URLscan is much tend to record keeping/verifying and analysis purpose.
We may consider using both in the right place within the lifecycle and UX suitable for community ecosystem purpose.
Sample
(I put some of recent active sites there but not getting attentions. Some of exchanges and myetherwallet are listed as targeting brands of phishing scams)
Now I understand Phishtank is a legacy public and crowdsourced phishing mail collection and validation platform, similar to Amazon Mturk is for catalog data correction and general questioner but looks like old and global rank 200K in Alexa
On Scam pages, add a "security suggestion" notification that is generated based off the category and subcategory of the scam. If one isn't already created, link to the mycrypto "securing your ethereum" KB article here: https://support.mycrypto.com/security/securing-your-ethereum.html
I'm not a spam account, I promise! My official twiter acount is @juansgalt, and you can find all my social accounts and work at juansgalt.com.
Much thankful for this most excellent fraud prevention app. Good work.
Both ico-ton.org and refereum-token.com are assigned on id #2805, which is the only exception of a unique id on URL to date shown through GET "https://etherscamdb.info/api/scams/"
Scams not updated on the website. Scams.yaml 2841 and above don't appear to be shown on the website, so the website is over a week behind the blacklist.
Reported on twitter, logging as an issue. https://twitter.com/sniko_/status/968650715957735424
A recommendation if not there already.
To pursue moving behavior of phishers, and keep the public records of them within URLscan as open repository, scan the site to take the snapshot when adding new id if it's not already in the pipeline.
i was not able to find phishing evidence of 4014: idex24.io within all the record about it including www.idex24.io
https://www.phishtank.com/user_submissions.php?username=seki
Added about 250 and the first half is well accepted and marked as phishes.
Here's some suggestion -
ETH Scam
We need an endpoint to get all scams where "status":"Inactive"
or "status":"Offline"
or "status":"Suspended"
.
For the URL myetherwalletverify.info,
the summary page indicates no Google protection as shown below,
but it's practically protected.
It should have different notation / logic / scope hopefully, to focus on high-risk address.
But by chrome, it is captured as below (no metamask nor etheraddresslookup)
Firefox
Safari
Onion + metamask
Onion
We need to include the ability for people to mass report phishing domains and scams through EtherScamDB.
.csv
file of reportsGet the user to select a .csv
file that is parsed client side and sent to the backend in a unified format.
Give a textbox to allow the user to dump the report (in no real uniform order/format). Kind of a free-for-all and won't make it easy for any future bots to parse and act on the data automagically.
With some UX magicy, allow the user to add more inputs to unifrm the order/format (1 input per domain/scam with a separated input with a reason)
Bugs:
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.