Abstract:The prosperity of Ethereum attracts many users to send transactions and trade crypto assets. However, this has also given rise to a new form of transaction-based phishing scam, named TXPHISH. Specifically, tempted by high profits, users are tricked into visiting fake websites and signing transactions that enable scammers to steal their crypto assets. The past year has witnessed 11 large-scale TXPHISH incidents causing a total loss of more than $70 million. In this paper, we conduct the first empirical study of TXPHISH on Ethereum, encompassing the process of a TXPHISH campaign and details of phishing transactions. To detect TXPHISH websites and extract phishing accounts automatically, we present TxPhishScope, which dynamically visits the suspicious websites, triggers transactions, and simulates results. Between November 25, 2022, and July 31, 2023, we successfully detected and reported 26,333 TXPHISH websites and 3,486 phishing accounts. Among all of documented TXPHISH websites, 78.9% of them were first reported by us, making TxPhishScope the largest TXPHISH website detection system. Moreover, we provided criminal evidence of four phishing accounts and their fund flow totaling $1.5 million to aid in the recovery of funds for the victims. In addition, we identified bugs in six Ethereum projects and received appreciation. Based on the detection results, we perform a comprehensive study of TXPHISH websites and phishing accounts. Our study reveals that TXPHISH websites have a short lifespan, low cost, and fast update frequency. Besides, Our analysis of phishing fund flow demonstrates that 54.0% of phishing funds ($43.7 million) flowed into centralized exchanges, where the identity of owners could be traced. Our research can serve as a valuable reference for Ethereum service providers to safeguard their users against TXPHISH and assist in the recovery of victims' crypto assets.

A Large-Scale Analysis of Phishing Websites Hosted on Free Web Hosting Domains

Phishpedia: A Hybrid Deep Learning Based Approach to Visually Identify Phishing Webpages

TxPhishScope: Towards Detecting and Understanding Transaction-based Phishing on Ethereum

PhishMatch: A Layered Approach for Effective Detection of Phishing URLs

Automated Phishing Detection Using URLs and Webpages

NoPhish: Efficient Chrome Extension for Phishing Detection Using Machine Learning Techniques

A Sophisticated Framework for the Accurate Detection of Phishing Websites

PhishLang: A Lightweight, Client-Side Phishing Detection Framework using MobileBERT for Real-Time, Explainable Threat Mitigation

Detecting Phishing sites Without Visiting them

Knowledge Expansion and Counterfactual Interaction for Reference-Based Phishing Detection

PhishAri: Automatic Realtime Phishing Detection on Twitter

DeltaPhish: Detecting Phishing Webpages in Compromised Websites

PhishingRTDS: A Real-time Detection System for Phishing Attacks Using a Deep Learning Model

PhishClone: Measuring the Efficacy of Cloning Evasion Attacks

HinPhish: an Effective Phishing Detection Approach Based on Heterogeneous Information Networks

PhishTransformer: A Novel Approach to Detect Phishing Attacks Using URL Collection and Transformer

PhishSim: Aiding Phishing Website Detection with a Feature-Free Tool

Phish What You Wish

Next Generation of Phishing Attacks using AI powered Browsers

HTMLPhish: Enabling Phishing Web Page Detection by Applying Deep Learning Techniques on HTML Analysis

Phishing Website Detection through Multi-Model Analysis of HTML Content