That Phishing Link in Your Comments Is Newer Than You Think

in #cybersecurity • 26 days ago

Every few months the same warning goes around on Steem: "Don't click the link in that comment, it's a phishing site." We repeat it, people resteem it, and a few weeks later the next wave arrives with a slightly different domain.

So here is a different angle. Instead of only asking "how do I spot a fake link?", let's look at how the people behind these links build their infrastructure, and why that same infrastructure is what gets them caught.

A short history of phishing on Steem

Phishing is not new here. Some examples from the chain's own history:

  • Clone frontends. Older warning posts named lookalike domains such as steewit.com, steelit.com and steemil.com. Each was one letter away from the real thing. They copied the Steemit login page and waited for people to paste their keys.
  • Comment spam from hijacked accounts. In March 2020, @guiltyparties posted "Warning: Phishing is back". It described threatening or tempting links dropped in comments that looked like real Steem frontends but weren't. The author estimated that more than 1,000 accounts were under phisher control at the time.
  • Shortened links. Readers kept warning that bit.ly style shorteners were used to hide where a link really goes.
    The pattern hasn't changed much. Recent posts on the chain still list the same signs: urgency, a domain one letter off, and a "login" that asks for your active or owner key.

The bigger picture: crypto phishing in numbers

Steem is a small slice of a much bigger problem. Scam Sniffer, a Web3 anti-scam company, tracks wallet-drainer phishing on EVM chains:

YearPhishing losses trackedVictims
2024~$494 million~332,000
2025~$83.85 million~106,000

The drop in 2025 sounds like good news, and partly it is. Scam Sniffer links it to some drainer groups shutting down and wallets adding better warnings. But the 2025 number is still about $84 million taken from more than 100,000 people, and that only counts what could be traced. The largest single 2025 case was $6.5 million, taken through one malicious signature request.

Scale also shows up in domain counts. Group-IB linked a single drainer operation, Inferno Drainer, to more than 16,000 malicious domains.

That last number is the key point of this post. Phishing is a domain business. Every fake login page, fake airdrop and fake "verify your wallet" site needs a domain. And domains leave a trail.

Why phishers are easier to track than they think

When you see one phishing link, it looks like a one-off. In reality, it's usually one of dozens or hundreds set up at the same time. To save time and money, scammers reuse things:

  1. The same registrant details. The same email, name or organization shows up across many domain registrations.
  2. The same DNS setup. The same nameservers (NS), mail servers (MX) or CNAME records are reused across a batch.
  3. Free hosting and site builders. Many phishing pages are not even on their own domain. They sit on subdomains of free builders like Weebly, GoDaddy Sites, Webflow or Cloudflare Pages, because those are free, fast and come with HTTPS.
  4. Fresh registrations. Lookalike domains are often only days old when the campaign starts.
    Defenders use each of these shortcuts as a "pivot". If you confirm that one domain is phishing, you can follow its registrant email or nameservers to find the sibling domains that haven't been used yet.

What a threat intelligence feed actually is

A threat intelligence feed is a machine-readable list of domains (or IPs) known to be involved in attacks. It's updated on a schedule so that security tools can block them automatically.

As one example, the WhoisFreaks Threat Intelligence Feed is built around exactly the pivoting idea above. According to WhoisFreaks, it works in three steps:

  1. Seed data. Start with domains confirmed as phishing, malware or spam.
  2. Pivot extraction. Pull out what those domains share: registrant email, phone, organization, NS, MX and CNAME records.
  3. Extrapolation. Match those pivots across a large WHOIS and DNS database to find related domains, often before anyone reports them publicly.
    WhoisFreaks says this approach expands about 1 million verified seed indicators into more than 28 million flagged domain records. The feeds come as daily CSV files in three domain categories (phishing, malware, spam), plus separate IP feeds for VPN, proxy, Tor, bot and command-and-control addresses.

Each record carries useful context, not just a bare domain:

  • threat_type: phishing, malware or spam
  • confidence: from 0 to 1, so teams can choose their own blocking threshold
  • first_seen / last_seen: when the domain entered the data and when it was last active
  • no_of_threat_matched_pivots: how many shared infrastructure links tied it to a known threat

A real example from crypto

The public sample of the phishing feed includes entries like:

  • 0000.tokenpocket1.yfzsjx.com: a subdomain built to look like TokenPocket, a well-known crypto wallet
  • dozens of subdomains on weebly.com, godaddysites.com, webflow.io and pages.dev
    That matches what's described above: brand impersonation of crypto wallets, hosted on free builders, buried under random-looking subdomains.

Who should care about this on Steem?

Frontend and dApp builders. If you run a Steem frontend, a wallet, a bot or a curation tool, you can check links in posts and comments against a domain feed and show a warning before anyone clicks. Several Steem community tools have tried this over the years with manually maintained blocklists. A pivot-based feed catches the sibling domains those lists miss.

Community moderators. A flagged domain with a recent first_seen date and several matched pivots is a strong reason to hide a comment. A gut feeling is not.

Everyday users. You don't need a feed to protect yourself. You just need the habits that feeds are built to back up.

A quick safety checklist for Steemians

  • Use your posting key for posting. No legitimate site needs your owner key to let you read or comment. Be very careful with your active key.
  • Type the frontend address yourself or use a bookmark. Don't log in from a link in a comment, DM or memo.
  • Read the domain from right to left. In steemit.com.login-verify.xyz, the real domain is login-verify.xyz, not steemit.com.
  • Distrust shortened links in comments and memos. Expand them first or skip them.
  • Urgency is a red flag. "Your account will be frozen", "rewards expire tonight" and "claim before midnight" are classic pressure tactics.
  • Check the domain's age with a WHOIS lookup when in doubt. A "Steem wallet" registered three days ago is not a Steem wallet.
  • If you entered a key on a strange site, change your keys immediately from the real wallet, then warn others.

Final thought

Phishing on Steem has always felt like whack-a-mole: one domain gets reported, three more appear. The difference now is that defenders can stop chasing single links and start mapping the infrastructure behind them. When one domain gets caught, its siblings can be flagged too.

Over to you: Have you ever received a phishing link on Steem, in a comment, a memo or a DM? What gave it away? Share it below (without the clickable link, please). Your example might save someone else's keys.

Sources

#phishing #steem #crypto #security
26 days ago in #cybersecurity by
100%
    10%25%50%75%100%
    $0.00
      1 vote
      Reply 2
      Sort:  
    • Trending