Someone lost $50,059 to address poisoning on Oct 28. In the week before, every new entry in their wallet history was fake

Scam Sniffer flagged this one on Oct 28: a wallet sent 50,059 USDT to 0xd967a1...92bd16f9 instead of 0xd967fb...ebbd16f9. Same first 4 and last 6 characters.

I went through that wallet's history. From Oct 21 until the loss, 48 new entries showed up. All 48 were fake. Not one real transaction in between.

Four different look-alike addresses were planting them, all starting with 0xd967 and ending in 16f9, all going after the same victim. Some even copied the exact amount of a real payment the owner had made to the right address in September: 85,012.92 "USDC", from a fake token that only looks like USDC.

Then on Oct 28 the owner opened the history, copied the address they thought they knew, and sent 50,059 USDT. Less than half an hour later they sent a 100 USDC test to the correct address, then the rest. So they noticed, just too late. The scammer's address now holds about 21 ETH.

It didn't stop there either. Since the loss another 67 fakes landed in that wallet, now from nine different look-alikes.

What bugs me most: scam lists usually mark an address like this after someone has already lost money. But the pattern is right there on-chain from the very first fake entry. So I made the explorer I'm building say it on the address page itself. This is the scammer's address on it: https://simplorer.app/ethereum/address/0xd967a1c9c81baed8d6ff0b2634c4764992bd16f9 Nobody had to report it. It works it out from the fake entries and from who really paid whom.

If you take one thing from this: - Never copy an address from your transaction history. Use your address book or copy it fresh from the source. - Check the whole address, not just the first and last few characters. - For big amounts, send a small test first and have the receiver confirm. - Not sure about an address? Paste it into an explorer before you send.

Has anyone here had their history flooded like this?