{
  "timestamp": "2025-02-05T22:43:03.697417",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a security advisor providing end-user guidance on data security and protection.\n            Focus on practical, easy-to-follow security recommendations."
      },
      {
        "role": "user",
        "content": "\n            Provide clear security guidance based on:\n            \n            Content to reference:\n            Search Free Trial Get Demo Phishing Targets Phantom Wallet December 13, 2021 Phantom is a browser based crypto wallet where you can store, send, receive, stake and exchange tokens in the Solana blockchain. With the skyrocketing prices of crypto currencies including SOL , a crypto wallet is one of the things we can use in order to get into the crypto currency action. Just recently there were several reports of wallets being wiped clean. An incident was reported by a user on twitter on how it happened. With just a copypasted message sent by a friend to a messenger group chat which includes a phishing link, he clicked it without verifying and it all went wrong from there. And now, they are trying to run pay per click campaigns to target more unsuspecting users. We previously reported fraudsters using online advertising in a phishing campaign that targeted Axie Infinity users through a fake Ronin wallet page. Malicious ads are not uncommon and large ad platforms like Google have processes to identify and remove fraudulent content. However, we were able to spot a fraudulent ad before it was quickly spotted and removed by Google. In this campaign, criminals trick users into creating a crypto wallet on a phishing site so the bad actors have access to the wallet. Once the victim transfers crypto into the wallet, the criminals steal the funds. Here is a step by step of the attack. Victims are lured to the phishing page with a fraudulent online ad. 2. The ad linked to a phishing page designed to mimic the real Phantom site. 3. The victims navigate the same user experience as they would when interacting with the real Phantom site. Below the user receives their Secret Recovery Phrase after choosing the Create New Wallet option 4. Then the user enters and confirms their wallet password. Note the user is still interacting with the phishing site. 5. Next the user receives instructions to open the malicious browser extension. 6. The criminals now have all the information from the victim they need to empty the crypto wallet. 7. And of course, to make the victim feel this process was legitimate, the Finish button redirected them to the actual Phantom site. Although the ads were immediately taken down, there were already several transactions done in the wallet that was created in the phishing page. This is mostly likely because the phishing page was used prior to it being published via the short-lived advertisement. Following the crypto currency transaction associated with the exposed wallet, some SOL ended up in this wallet which contains over 870,00 SOL.  It is the same wallet that was used when the Nobu Ninjas NFT minting website was hijacked via DNS cache poisoning. Details of how the hacking transpired are on Nobu Ninjas Twitter page . Best Practices and Recommendations As of this writing, the phishing page has been suspended. Users are advised to verify every link before clickingopening the site. Also, browser based crypto wallets need to be installed first as an extension in the browser, not after creating the wallet. In this scenario, the option to create a wallet comes first so it should trigger a red flag that it most probably a phishing page. IOCs httpsphhanton.app httpsphanton-account.website httpsphanton-account.space References    Find out how to investigate targeted phishing incidents. Read the Playbook Try it for Free Instant Data Classification Cyren URL Category Chacker Prev JavaScript Obfuscation in Phishing Sites 13 Types of Social Engineering Attacks Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n            \n            Your guidance should include:\n            1. Easy-to-follow security best practices\n            2. Data protection recommendations\n            3. Safe usage guidelines\n            4. Common security risks and prevention\n            5. Privacy protection measures\n            6. When to seek additional security support\n            "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "### End-User Security Guidance: Protecting Your Data and crypto Assets\n\n**1. Security Best Practices:**\n   - **Verify Links and Sources:** Always double-check the URL of any website you visit, especially if you\u2019re dealing with financial or crypto-related activities. Look for \"https\" in the URL and ensure the domain name is correct (e.g., \"phantom.app\" instead of \"httpsphanton.app\").\n   - **Be Cautious with Ads:** Avoid clicking on suspicious ads, especially those promising free trials, demos, or urgent offers. Legitimate companies rarely advertise via unsolicited ads for crypto wallets.\n   - **Install Browser Extensions Safely:** Only install browser extensions from official stores (e.g., Chrome Web Store). Never install extensions from links provided in unsolicited messages or ads.\n\n**2. Data Protection Recommendations:**\n   - **Protect Your Private Keys:** Your Secret Recovery Phrase is the key to your crypto wallet. Never share it with anyone or enter it into any website unless you are certain it\u2019s the legitimate platform.\n   - **Use Strong Passwords:** Create unique, complex passwords for your wallet and associated accounts. Avoid reusing passwords across multiple platforms.\n   - **Enable Multi-Factor Authentication (MFA):** Add an extra layer of security by enabling MFA for your wallet and exchange accounts.\n\n**3. Safe Usage Guidelines:**\n   - **Avoid Phishing Sites:** Be wary of websites that ask you to create a wallet or enter your recovery phrase immediately. Legitimate wallet providers typically guide you through a secure setup process.\n   - **Don\u2019t Click on Unverified Links:** If a friend or colleague sends you a link, verify its authenticity before clicking, especially if it relates to financial transactions.\n   - **Regularly Update Software:** Keep your browser, wallet software, and operating system updated to protect against known vulnerabilities.\n\n**4. Common Security Risks and Prevention:**\n   - **Phishing Attacks:** Be aware of fake websites designed to mimic legitimate ones. Look for spelling mistakes, unusual URLs, or inconsistent branding.\n   - **Scam Ads:** Fraudulent ads often promise quick riches or exclusive offers. If an ad seems too good to be true, it probably is.\n   - **Social Engineering:** Attackers may pose as friends, support agents, or celebrities to trick you into sharing sensitive information. Always verify the identity of the person contacting you.\n\n**5. Privacy Protection Measures:**\n   - **Keep Your Recovery Phrase Offline:** Store your Secret Recovery Phrase in a safe, offline location, such as a hardware wallet or a secure note.\n   - **Limit Sharing of Personal Information:** Avoid sharing personal or financial information online, especially in public forums or chat groups.\n   - **Use a VPN:** When accessing financial accounts or crypto wallets on public Wi-Fi, use a VPN to encrypt your connection.\n\n**6. When to Seek Additional Security Support:**\n   - **Suspected Compromise:** If you suspect your wallet or account has been compromised, immediately contact the platform\u2019s support team and change your passwords.\n   - **Unusual Activity:** If you notice unauthorized transactions or suspicious activity, report it to the relevant authorities and your crypto wallet provider.\n   - **Advanced Threats:** If you\u2019re targeted by sophisticated phishing campaigns or ransomware, seek help from a professional cybersecurity expert or your organization\u2019s IT department.\n\n### Conclusion:\nCrypto wallets like Phantom offer convenient access to blockchain services, but they require careful security practices to protect your assets. Stay vigilant, verify every link and transaction, and never share sensitive information. If in doubt, err on the side of caution and seek advice from trusted sources.",
    "usage": {
      "prompt_tokens": 815,
      "completion_tokens": 1425,
      "total_tokens": 2240
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}