Scenario: A DeFi platform reported multiple users hit by unauthorized fund withdrawals.
A forensic review uncovered a phishing site impersonating the legitimate PancakeSwap exchange, luring victims
into entering their wallet seed phrases. The kit was hosted on a compromised server and exfiltrated stolen
credentials via a Telegram bot. The task: read the kit's source directly to map its infrastructure, IOCs, and the
developer's own footprint left behind in the code.
Q1Which wallet is used for asking the seed phrase?
The extracted kit's
index page contains a MetaMask-branded "Continue with Seed Phrase" import flow — a direct clone of the real wallet's UI.answerMetaMask
Q2What is the file name that has the code for the phishing kit?
answermetamask.php
Q3In which language was the kit written?
answerPHP
Q4What service does the kit use to retrieve the victim's machine information?
The PHP source calls
api.sypexgeo.net/json/ with the victim's REMOTE_ADDR to resolve their country, city, and approximate location before logging the theft.answerSypex Geo
Q5How many seed phrases were already collected?
The kit's local
log.txt stores every harvested seed phrase in plaintext, one per line.answer3
Q6Could you please provide the seed phrase associated with the most recent phishing incident?
answerfather also recycle embody balance concert mechanic believe owner pair muffin hockey
Q7Which medium was used for credential dumping?
The
sendTel() function ships every captured secret phrase straight to a Telegram bot via api.telegram.org.answerTelegram
Q8What is the token for accessing the channel?
answer5457463144:AAG8t4k7e2ew3tTi0IBShcWbSia0Irvxm10
Q9What is the Chat ID for the phisher's channel?
answer5442785564
Q10What are the allies of the phish kit developer?
A commented-out "shoutout" block left in the source — a common signature move among kit authors who sell/share their tools within underground crews.
answerj1j1b1s@m3r0
IOC Summary
| Item | Value |
|---|---|
| Impersonated Brand | MetaMask / PancakeSwap |
| Kit File | metamask.php (PHP) |
| Geolocation Service | Sypex Geo (api.sypexgeo.net) |
| Seed Phrases Harvested | 3 |
| Exfil Channel | Telegram Bot API |
| Bot Token | 5457463144:AAG8t4k7e2ew3tTi0IBShcWbSia0Irvxm10 |
| Chat ID | 5442785564 |
| Developer Handle | j1j1b1s@m3r0 |
Lessons learned: Crypto phishing kits rarely reinvent the UI — they clone the real wallet's
import flow pixel-for-pixel, which makes visual triage unreliable and source review essential. Telegram bots remain
the exfiltration channel of choice for commodity kits: cheap, fast, and the token + chat ID pair extracted from the
source is often enough to pull the attacker's entire victim log directly from the Telegram Bot API, no warrant
required. Kit authors frequently leave a "signature" in commented-out code — a nickname, a shoutout, an alias —
which is genuinely useful for attribution and for spotting the same kit reused across other phishing campaigns.