GuildOfGuardians[.]net: Scammer ETH Addresses

Etherscan is your friend.

If you're new to Crypto you may not have spent much time on the various blockchain explorers, but they are very handy when you want to understand where your funds are going when you send them to an address.

https://etherscan.io/

You can take any address and double check that it looks legitimate before you transfer funds.  For example, this is the contract address for the GoG token:

0x9AB7bb7FdC60f4357ECFef43986818A2A3569c62

If you search for that address on Etherscan (https://etherscan.io/token/0x9AB7bb7FdC60f4357ECFef43986818A2A3569c62) it will look like this: 


The Token is called Guild of Guardians (although that title could be faked), the supply is 1,000,000,000 GoG which is what I expect based on the Guild of Guardians whitepaper, there are 1,811 holders (I expected more actually) and there have been 8,139 transfers.  You can also take a look at the transfers down below and there are some from SushiSwap: GOG, CoinList, and if you own GoG your address will come up on the transfers too.

However, tonight I took a little time to scour though the source code of the webpage hosted at GuildOfGuardians[.]net to see if I could get any indication of what addresses the scammers were using to receive funds.

I turned up the following wallet addresses after looking through the pages source code:

0x5e3d6Fc405d8060BC7C41b5f56f6C05AC66aCF8e

0x82374224c9c03388F40a146E286A7799b333DA72

0xf319B5047d657c054C73908308E4C22A98dC7C22

0x7Dd59016d418b72Ffa2A9857F9fb6a99b8d80E4C

0x71C7656EC7ab88b098defB751B7401B5f6d8976F

0x89205A3A3b2A69De6Dbf7f01ED13B2108B2c43e7

0xfa9def342411e2fa16f9a823e8f6d46dc173ca5

The last one however seems to be missing a character and so doesn't show up on Etherscan.

If you take the first address and search for it in Etherscan you get the following:




This address is a wallet address by the looks of it, not connected to any sort of contract.  The balance is relatively low, and if this were the destination for the funds of an NFT sale you would probably expect a higher balance at least during the sale.  The transactions on the address sort of drip money into the wallet, which is also unlike what you'd expect from the wallet for an NFT sale.  This really looks like someone's private wallet.

On Etherscan there is also a comments section.  You can jump to the comments section and read what people have to say about this wallet address.  Generally you should take these comments with a grain of salt, but the very first comment identifies this wallet as a scam address, then the next comment under that also identifies this wallet as a scam address, and so on.  If several comments identify the wallet as a scam address you can be pretty confident the address is associated with a scam.

Compare this with the comments section of the Guild of Guardians presale contract address:


You can take a look at the other addresses I pulled out of the fake Guild Of Guardians website on Etherscan, and none of them look legitimate.  You can also compare them to the actual GoG presale contract address: 0xc253CbC67556E797FDB750a031D5E6208C423ad5

Finally, I found these addresses while digging around in the source code for the fake Guild of Guardians site, but if you are performing a transaction using Metamask you can check the destination address of the transaction before you sign it like this:


In this case the destination is 0xE592427A0AEce92De3Edee1F18E0157C05861564.  Check out the address for yourself and see if you think the transaction in the picture above was to a legit contract or not.

That's it for now.  If you come across any GoG related scams don't hesitate to @gogscamtracker on Twitter or email report@gogscamtracker.com.  I'm going to go avatar shopping...





Comments

Post a Comment

Popular posts from this blog

Down MetaMask Impersonation Rabbit Hole

Image
It's Friday night.  I should be doing something else.  I have a VR headset literally two feet away from me collecting dust, and what I am I doing?  I'm scouring the internet for more sites that have implemented a specific MetaMask impersonation technique. I created a short video demonstrating the technique, and if you're curious you can check it out here: https://youtu.be/OJu9HlJ2wsc At first it was just a few Guild of Guardians sites that I found and managed to get taken down, but shortly after I decided to leverage dnstwist to find some additional look-a-like domains, and after adding the tld swap option I uncovered even more. I noticed a pattern though, two IP addresses kept coming up in connection with this particular MetaMask impersonation: 5.61.58.93 and  45.136.50.34 If you want to know what all is hosted on a particular server you can leverage tools like VirusTotal.  In some cases you'll come across IP addresses used by shared hosting providers, in other words y
Read more

NameSilo Abuse Reporting

Image
On Sunday I sent a message to NameSilo (abuse@namesilo.com) regarding the following token scam websites: guildofguardianes[.]com guildofguardians[.]net guildofguardian[.]net guildofguardians[.]cc It's hard to predict the response for any given domain registrar.  Some are really responsive, but in my experience if you want to get something done quickly you need some kind of pre-existing relationship with the registrar in question.  This is where companies like Phishlabs (https://www.phishlabs.com/) shine with their brand protection services as they automate the process of requesting takedowns for their clients and invest in maintaining strong relationships with registrars. As an independent researcher, my success with getting sites taken down varies. In this case I received an automated response directing me to their "Report Phishing Form" hosted at https://new.namesilo.com/phishing_report. I can only imagine the volume of phishing reports this registrar gets, and there
Read more

More Sites Taken Down

 Last week I received responses from NameSilo confirming they took action on the following domains: zerions[.]info zerions[.]com guildofguardians[.]org guildsofguardians[.]me guildofguardians[.]top I'm very impressed with NameSilo's response time, they've been very cooperative.  If anyone from NameSilo happens to read this article, thank you so much! I still have several domains to work my way through hosted on the same servers.  It's easy to drown in the amount of scams around crypto, so I try to focus on Guild of Guardians related scams, but it's difficult to leave the others hanging.  I'm hoping to get through reporting the rest of the domains soon. A bit of a short update, but it's been a bit of a crazy week last week.  Will write up a more comprehensive update this week. Stay safe out there, and if you see anything suspicious you can always reach me @gogscamtracker on Twitter or email report@gogscamtracker.com.
Read more