7 Methods of Stealing Your Seed Phrase
| Method | Sites | How It Works | Speed | Cost |
|---|---|---|---|---|
| Telegram Bot | #1 | Express.js on Render.com proxies to Bot API. Scammer gets instant DM with credentials. | Real-time | $0 |
| EmailJS | #1, #4 | Client-side JavaScript sends directly to EmailJS API, which delivers to scammer's email. | ~1 min | $0 |
| Un-static Forms | #2, #3 | Standard HTML form POST to a legitimate form service that forwards submissions via email. | ~1 min | $0 |
| FormSubmit.co | #7 | jQuery AJAX to FormSubmit.co. Email address hidden behind MD5 hash. Campaign tagged as "DAPP DECENTRALIZED". | ~1 min | $0 |
| Custom C2 API | #6 | React SPA sends to nginx/Express API behind Cloudflare. Drops GET requests (522) to evade scanners. Only responds to POST. | Real-time | ~$5/mo |
| PHP + DDNS | #8 | PHP script on a home computer via free Dynamic DNS (publicvm.com). Seed phrase sent word-by-word. | Real-time | $0 |
| PhaaS API | #5 | UUID-based multi-tenant API. Central operator manages backend, scammers rent endpoints. | Real-time | Unknown |
Complete IOC Table
For security teams, threat intel platforms, and abuse reporters:
Domains & Infrastructure
| Domain | Type | Status |
|---|---|---|
|
networklayers.pages.dev |
Phishing frontend |
Live |
|
token-aqla.pages.dev |
Phishing frontend |
Live |
|
antiresolve-mysafpalnode.pages.dev |
Phishing frontend |
Live |
|
flaremainnet.pages.dev |
Phishing frontend |
Live |
|
swiftauthapps.pages.dev |
Phishing frontend |
Live |
|
emailjs-backend-ovtg.onrender.com |
TG relay backend |
Live |
|
portal.flaremainet.com |
Typosquat assets |
Unknown |
|
layerschain.in |
Related domain |
DNS Dead |
|
api.pulseresolve.com |
PhaaS backend |
NXDOMAIN |
|
walletissuesfix.net |
Asset host |
NXDOMAIN |
|
syncwallet.online |
Logo host |
NXDOMAIN |
|
pumpeth.com |
Image CDN |
Live (AWS) |
|
wallet-support-39n.pages.dev |
Phishing frontend |
Live |
|
ledger-recovery.support |
Ledger phishing (Replit) |
Live |
|
api.uranustoken.org |
C2 backend (nginx/Ubuntu) |
Live |
|
uranustoken.org |
Root domain |
404 |
|
mainnetvalidationapp.pages.dev |
Phishing frontend |
Live |
|
pub-519769e9eb634616b1746c2018641d56.r2.dev |
Phishing (R2 bucket) |
Offline |
|
mercifuljigga4real123.publicvm.com |
PHP backend (DDNS) |
NXDOMAIN |
Accounts & Identifiers
| Type | Value | Site |
|---|---|---|
|
Email |
Bestgrace309@gmail.com |
#1 |
|
Email (hidden) |
support@layerschain.in |
#1 |
|
Telegram Bot |
@DewdropsTG_bot (7567323692) |
#1 |
|
Telegram User |
@metatech2 (7350941887) |
#1 |
|
EmailJS #1 |
service_d5qigxs / I-7q0Bs-ilK3rFcWj |
#1 |
|
EmailJS #2 |
service_6dt5h1k / Sza6lhzA9hKHrm1k4 |
#4 |
|
EmailJS #3 |
service_isy47de / JsVEgXVcaSTro1etu |
#4 |
|
Un-static Form |
c78173e2d991…94c3f76 |
#2 |
|
Un-static Form |
6f1b82c3ce55…da9943af |
#3 |
|
PhaaS UUID |
a26db20c-1dc4-4208-a60a-c2c3b22c02ef |
#5 |
|
GTM |
GTM-WX2D2TR |
#4 |
|
MS Clarity |
j4bllybjkp |
#4 |
|
Render Instance |
rndr-id: ed83576e-b1b3-4c82 |
#1 |
|
Replit Verify |
a43d3852-5304-47af-a61b-f0f6f3912736 |
#6 |
|
FormSubmit MD5 |
a2cf4131f1a5d39453c7c183df96f86f |
#7 |
|
Campaign Tag |
DAPP DECENTRALIZED |
#7 |
|
FontAwesome Kit |
bdc3291137 (kit #112310842) |
#7 |
|
R2 Bucket ID |
519769e9eb634616b1746c2018641d56 |
#8 |
|
Username/DDNS |
mercifuljigga4real123 |
#8 |