Crypto security service Scam Sniffer added five newly verified malicious indicators to its real-time blocklist shortly after October 13 began, including three websites classified as wallet drainers, a seed-phishing domain and a cryptocurrency address identified as a drainer wallet.
The additions appeared within roughly an hour of one another. In a scan of Scam Sniffer’s live feed at approximately 01:26 Cairo time on October 13, claim-rewards-eigen[.]xyz had been added about four minutes earlier and classified as a drainer, while wallet-rectify-sync[.]com had appeared about 11 minutes earlier and was classified as seed phishing.
A third domain, app-uniswap-fi[.]net, was listed as a drainer and had been added roughly 26 minutes earlier. Scam Sniffer also added wallet address 0x9f21…c4ae as a drainer wallet approximately 41 minutes before the scan, while airdrop-checker-l2[.]io had been identified as a drainer around one hour earlier.
All five therefore fell inside October 13 in Cairo time. There is currently no public evidence showing that they were created by the same operator, use the same drainer infrastructure or form part of a coordinated campaign. They should be treated as separate threat-intelligence leads unless technical evidence later connects them.
Two of the Domains Invoke Familiar DeFi Themes
The names themselves illustrate several common approaches used in cryptocurrency phishing.
app-uniswap-fi[.]net incorporates the Uniswap name and an “app” prefix that resembles the structure users might expect from a DeFi interface. The legitimate Uniswap web application operates at app.uniswap.org, making close inspection of the full hostname critical before a wallet is connected or a transaction is signed.
The pattern is similar to the fake Safe wallet advertisement that appeared in Google search results on October 11. That case used a lookalike domain and familiar branding to position a fraudulent interface in front of users searching for a legitimate crypto product.
claim-rewards-eigen[.]xyz, meanwhile, combines “claim,” “rewards” and “Eigen” — language naturally associated with token incentives and staking ecosystems. The Eigen Foundation has separately warned users about fraudulent websites impersonating its services and directs users to verify claim interfaces through its official channels.
The domain name alone cannot establish exactly how the newly blocked site operated. Scam Sniffer’s classification does, however, identify it as a wallet drainer rather than merely a suspicious lookalike.
Seed Phishing Creates a Different Kind of Wallet Compromise
The most technically distinct entry is wallet-rectify-sync[.]com, which Scam Sniffer classifies as seed phishing.
A drainer website generally attempts to persuade a user to authorize a malicious transaction, token approval, permit or other wallet action. Seed phishing instead attempts to obtain the recovery phrase or private-key material itself.
That difference is critical.
A malicious approval may sometimes be revoked before it is exercised, depending on the authorization and timing. A disclosed recovery phrase is fundamentally different because the attacker can reconstruct the wallet independently. Removing a browser connection or revoking a token allowance cannot make an exposed seed secret again.
Ethereum’s security guidance describes the recovery phrase as the master key to a wallet and warns users never to provide it to a website or support representative. Once exposed, remaining assets generally need to be migrated to a newly generated wallet whose keys have never been disclosed.
The “rectify” and “sync” language in the newly blocked domain is also familiar social-engineering territory. Crypto phishing operations frequently present seed requests as wallet synchronization, validation, migration or technical repair rather than openly asking users to hand over control of their assets.
Airdrop Lures Remain an Efficient Route Into Wallets
The fifth domain, airdrop-checker-l2[.]io, was classified by Scam Sniffer as a drainer.
Airdrop-related pages are particularly useful to attackers because the expected user journey already involves connecting a wallet, checking eligibility and potentially signing something. The malicious action can therefore be hidden inside behavior that looks normal for a token distribution.
This is why the transaction itself matters more than the marketing language surrounding it. Dave Finances’ guide on how to identify a crypto scam before connecting a wallet distinguishes simple wallet connections from approvals, permits, direct transfers and broader authorization mechanisms that may give an attacker access to assets.
A button labeled “check eligibility” or “claim rewards” says nothing about the actual authority requested in the wallet prompt.
The Blocklist Is Evidence of Malicious Infrastructure, Not Confirmed Losses
It is important not to infer victim losses from the presence of the five indicators on Scam Sniffer’s feed.
Scam Sniffer says candidates enter its detection pipeline from multiple sources and are verified before being distributed through its blocklists. Automated checks are used first, with human review where classification is less clear.
The service says it has scanned more than 47 million URLs, identified more than 705,000 scams and maintains more than 258,000 malicious domains and addresses in its blocklists.
But a verified malicious domain does not prove that anyone visited it, signed a transaction or lost money. Likewise, identifying an address as a drainer wallet does not by itself establish how much cryptocurrency it received from victims.
No independently verified losses have yet been connected publicly to this particular five-indicator group.
Wallet Drainers Remain a Material Threat Despite Falling 2025 Losses
The additions arrive after a sharp decline in measured signature-phishing losses last year, but Scam Sniffer’s own figures show why the threat remains economically significant.
Its 2025 report tracked approximately $83.85 million stolen from 106,106 victims through wallet-drainer phishing across EVM-compatible chains. That was down 83% from the $494 million recorded in 2024, while the number of identified victims declined 68%.
The largest individual case in 2025 still reached $6.5 million. Permit and Permit2 signatures accounted for a substantial portion of losses in the largest cases, while malicious EIP-7702 activity emerged after Ethereum’s Pectra upgrade.
The implication is that declining annual losses do not mean the underlying infrastructure has disappeared. Domains can be created rapidly, blocked and replaced while attackers continually change branding, lures and transaction mechanisms.
The Five Indicators Show How Fragmented Crypto Phishing Has Become
The most useful interpretation of the October 13 additions is therefore not that a new five-domain campaign has suddenly appeared. There is no evidence for that conclusion.
Instead, the feed captures several different attack surfaces appearing almost simultaneously: a branded DeFi-style drainer, a reward-themed domain, a seed-phrase phishing site, a generic airdrop lure and a malicious wallet address.
That fragmentation makes defense harder. Security teams are not looking for one stable website or one recognizable scam template. They are dealing with disposable domains, rapidly changing wallet addresses and lures adapted to whatever activity users already expect to perform.
Recent incidents also show how distribution can be as important as the malicious site itself. In another example, Coldcard’s official X account posted a phishing link on October 11, demonstrating that attackers can potentially reach users through channels they already regard as trustworthy.
For investors, that means a blocklist warning is most useful before the signature happens. Once a seed phrase has been surrendered or an irreversible malicious transaction has executed, identifying the domain afterward may help investigators but cannot automatically recover the assets.
The Next Question Is Whether Any of These Leads Converge
The investigative value of the five October 13 indicators will increase if researchers can connect them through infrastructure or on-chain behavior.
Shared hosting, registrar information, analytics identifiers, wallet destinations, smart-contract code, transaction-signature patterns or common funding sources could eventually show that two or more belong to the same operation.
For now, that connection has not been demonstrated publicly.
The stronger finding is simpler: within roughly one hour, Scam Sniffer’s live system verified multiple new pieces of malicious infrastructure targeting several of the most sensitive actions a self-custody user can perform — connecting to DeFi applications, claiming rewards, checking airdrops and handling recovery phrases.
None has yet been tied to a disclosed loss figure. But the speed with which the indicators appeared is a reminder that crypto phishing is not only measured in the large thefts that eventually make headlines. Much of the threat develops earlier, at the stage when a newly created domain or wallet is circulating and security systems are racing to identify it before a user becomes the first confirmed victim.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574