Monthly report attached - April 2023


Bad sites detected and shared with vendors for removal: 14


UrlScan IoCs
Balancer



Search Balancer (1996 hits in 30 files of 30 searched)

Search "(app-balancer|balancer-app|bolancer|balancer|balahcer|bqlancer|baIancer|balencer|baiencer|balancer-fi|balancer-fl|baiancer-fi|balencer-fi)" (1996 hits in 30 files of 30 searched)



As balancer is a common word and "Load Balancer" is often registered and present in subdomains alike, there is a lot to filter though, but the real number of scams is fairly low, about a dozen from almost 2000



Sneak Peek in my abuse inbox


Metamask, airdrop, walletconnect, etc:

Search "walletconnect" (13 hits in 8 files of 30 searched)
Search "trustwallet" (38 hits in 15 files of 30 searched)
Search "sushiswap" (47 hits in 16 files of 30 searched)
Search "pancakeswap" (159 hits in 28 files of 30 searched)
Search "metamask" (644 hits in 30 files of 30 searched)
Search "elonmusk" (305 hits in 30 files of 30 searched)
Search "coinbase" (2012 hits in 30 files of 30 searched)
Search "airdrop" (458 hits in 30 files of 30 searched)





jaw drop clip art - Clip Art
        LibraryTotal potential bad hits for the month ~44K

Search "(usdc|claim|coinbase|colnbase|c0inbase|c0lnbase|cornbase|coirbase|balancer|balahcer|bqlancer|baIancer|[a-zA-Z]*1inch[a-zA-Z]*|[a-zA-Z]*1inch-[a-zA-Z]|[a-zA-Z]*oneinch[a-zA-Z]*|a-zA-Z]*1-inch[a-zA-Z]*|a-zA-Z]*1-inch[a-zA-Z]*|[a-zA-Z]*1inch[a-zA-Z]*|[a-zA-Z]*pancakesw[a-zA-Z]*|[a-zA-Z]*pancakesv[a-zA-Z]*|[a-zA-Z]*pancokesv[a-zA-Z]*|[a-zA-Z]*pancokesw[a-zA-Z]*|[a-zA-Z]*pancakosw[a-zA-Z]*|[a-zA-Z]*pancakkesw[a-zA-Z]*|[a-zA-Z]*pancake5[a-zA-Z]*|[a-zA-Z]*uniswap[a-zA-Z]*|[a-zA-Z]*uniswap-[a-zA-Z]|[a-zA-Z]*unisvap[a-zA-Z]*|a-zA-Z]*unisvap[a-zA-Z]*|a-zA-Z]*uni-[a-zA-Z]*|[a-zA-Z]*unisvv[a-zA-Z]*|unlswap"|[a-zA-Z]*uniswap[a-zA-Z]*|[a-zA-Z]*uniswap-[a-zA-Z]|[a-zA-Z]*unisvap[a-zA-Z]*|a-zA-Z]*unisvap[a-zA-Z]*|a-zA-Z]*uni-[a-zA-Z]*|[a-zA-Z]*pancakesw[a-zA-Z]*|[a-zA-Z]*pancakesv[a-zA-Z]*|[a-zA-Z]*pancokesv[a-zA-Z]*|[a-zA-Z]*pancokesw[a-zA-Z]*|[a-zA-Z]*pancakosw[a-zA-Z]*|[a-zA-Z]*pancakkesw[a-zA-Z]*|[a-zA-Z]*uniswap[a-zA-Z]*|[a-zA-Z]*uniswap-[a-zA-Z]|[a-zA-Z]*unisvap[a-zA-Z]*|dapp|wallets|wallect|synchr|rectify|unlock|walet|1inch|airdrop|ethereum|walet|wallet|coinbase|uniswap|pancakeswap|liquidity|vvallet|metamask|metamaks|metemask|metamaks|paraswap|exchange|liquidity|kraken|bitso|dapp|sushiswap|sushlswap|sushisvv|opensea|polygon|walletconnect|waletconect|waiietconnect)" (44662 hits in 30 files of 30 searched)



Multiple offenders exposed and banned in Discord







Warnings issued Discord

Fake exploit
"IMPORTANT: AN EXPLOIT HAS BEEN DETECTED AND IS BEING MITIGATED BY OUR SECURITY TEAM, WE URGE ALL HOLDER AND SHAREHOLDERS TO SECURE THEIR ASSETS TO AVOID ANY FURTHER DAMAGE. "
i also made a blog post about it - so of anybody searches for this text in google they may find my warning https://spamreports.report/post/715835843550511104/scam-balancer




Fake Bals & Fake mint




419 scam


Fake apps Google play store taken down - just 1 this month

Just one crypto specific, others are mobile trojans that could steal your assets as well if a malicious actors takes control over a Mobile device.


18 GH pull requests (dot and metamask anti-phish repos) in April


https://github.com/dubstard



MetaMask/eth-phishing-detect Block 151 scam URLs 
#12382 by dubstard was merged 5 days ago Approved
MetaMask/eth-phishing-detect Block some scams 
#12374 by dubstard was merged last week Approved
polkadot-js/phishing Block 6 scam URLs 
#3284 by dubstard was merged last week Approved
MetaMask/eth-phishing-detect Block 106 Scam URLs 
 blocklist requestIssue or PR requesting to addition to the blocklist
#12302 by dubstard was merged last week Approved
MetaMask/eth-phishing-detect Block 61 scam URLs 
#12265 by dubstard was closed 3 weeks ago Review required


MetaMask/eth-phishing-detect Block 73 scam URLs 
#12237 by dubstard was merged 3 weeks ago Approved