CryptoINT_Researcher @CryptointR

Posts warning about cryptocurrency related scams Joined February 2020

Tweets

1K
Followers

86
Following

133
Likes

270

CryptoINT_Researcher @CryptointR

2 days ago

3/3 🛠 C2 & Live Social Engineering: The site connects back to operators using real-time WebSockets (/ws) with an SSE fallback (/api/vault/events). Operators track victim activity via /api/vault/audit and can dynamically trigger live chat or fake KYC popups to manipulate victims.

0 0 0 19 0

View Details

CryptoINT_Researcher @CryptointR

2 days ago

2/3 🔍 Attack Flow: • Access Gate: Demands 6-digit code or auto-bypasses targets via ?sessionTransfer= • Seed Harvesting: Steals 12-word recovery phrases via /api/vault/restore-seed • Spoofed Dashboard: Fakes incoming balances and sets withdrawal hold timers to trap funds.

1 0 0 44 0

View Details

CryptoINT_Researcher @CryptointR

2 days ago

1/3 🚨 Newly registered phishing domain impersonating @binance Vault: 🌐 Domain: liveness-binance[.]com 📅 Registered: 12 October The site serves a single-page application built to harvest credentials and siphon crypto assets. Technical breakdown 👇 @binanceHelpDesk

1 0 0 70 1

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

@realScamSniffer @PocketUniverseZ @blowfishxyz @CertiKAlert

0 0 0 28 1

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

Attacker Spender:0x464a32310881825508993415E21f58F0CA0C9C16 Target Token (Arbitrum USDT):0xFd086bC7CD5C481DCC9C85ebE478A1C0b69FCbb9 Exfil Channel ID: 1471216429197164617 Hosting Platform: Netlify (Site ID: 77482f08-ea9e-4f27-9611-8d8225934da3)

1 0 0 35 0

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

🚨 Phishing & Web3 Alert: EIP-2612 USDT Drainer on Arbitrum One usdtverify[.]online Phishing lure masquerading as an official "USDT Verification" page. The campaign leverages off-chain EIP-712 Permit signatures to steal funds gas-free without an upfront on-chain approve() alert

1 1 0 281 1

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

7/7 🌐 IOCs • Lure: ledgerproporsal[.]com • C2: vitmass[.]com • IP: 188.253.11.18 • Cert CN: FRZGNU0NTD6EDPD.549121

0 0 0 32 0

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

6/7 🛡️ File Hashes (SHA-256) • ZIP: 39438314580cd65e73c02d664df8183e218ec409021b327aff317df4c584fbec • BAT Dropper: 1abf3f6ac62e8f1f390ecf062a9a154c10eaf3a2c8f2b962ad02e37e5a6ddab9 • ScreenConnect MSI: c0fb7911a2ca099632e39172a5dce9356d4aa960afa5b90bc8479bc31a6793e5

1 0 0 86 0

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

1/7 🧵 Fake @Ledger Proposal Drops ScreenConnect via DocuSign Decoy A Web3 phish on ledgerproporsal[.]com lures targets with a fake proposal. Runs a real DocuSign installer as a decoy while silently installing weaponized ScreenConnect RMM backdoor. 👇 @Ledger_Support

2 1 1 968 2

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

🚨 SCAM ALERT: XRPL wallet drainer targeting @XamanWallet • Domain: ledger-allocation[.]app • Lure: Spoofed "Xaman Airdrop / XRPL Allocation" • Vector: Malicious Web3 modal targeting Xaman, WalletConnect, Ledger, Crossmark Triggers malicious signing payloads to drain assets

0 0 0 166 1

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

@Ledger_Support @Ledger The scam flow: Prompts hardware selection (Nano, Flex, Stax) Simulates a failed connection Triggers "Use alternative method" Prompts manual entry of 12, 18, or 24-word recovery phrases

0 0 0 288 0

View Details

CryptoINT_Researcher @CryptointR

2 weeks ago

🚨 SCAM ALERT: Campaign impersonating @Ledger_Support with a fake "2026 Exploit" advisory claiming $150M in losses. • exploits2026-ledger[.]app Lure: Claims older @Ledger devices have weak-entropy seeds via a fake MicroPython/Yasmarang bug to push a "risk scan."