谨防诈骗：Discord 私信钓鱼手法分析

慢雾科技Pubblicato 2022-05-18Pubblicato ultima volta 2022-05-18

Introduzione

各种钓鱼手法和事件层出不穷，用户要学会自己识别各种钓鱼手法避免被骗，项目方也要加强对用户安全意识的教育。

事件背景
5 月 16 日凌晨，当我在寻找家人的时候，从项目官网的邀请链接加入了官方的 Discord 服务器。在我加入服务器后立刻就有一个"机器人"(Captcha.bot)发来私信要我进行人机验证。这一切看起来相当的合理。我也点击了这个验证链接进行查看。

钓鱼手法分析
我访问"机器人"(Captcha.bot)发来的链接后，是有让我进行人机验证的，但是当我验证通过后，发现它要求唤起我的小狐狸(MetaMask)钱包，唤起的钱包界面挺真实的，如下图所示，但是我看到了钱包的地址栏显示"about:blank"这引起了我的警惕（平时审计了不少插件钱包），如果是插件唤起的就不会有这个"about:blank"的地址栏了。
接下来我随意输入了密码，并且通过审查元素查看，确定这个小狐狸(MetaMask)界面是由虚假网站"https://captcha.fm/"弹出的，并不是真实的钱包界面，于是我开始调试这个钱包。

在随意输入密码后，这个虚假的钱包界面进入到"Security Check"界面，要求我输入助记词进行验证。注意，输入的密码和和助记词会被加密发送到恶意站点的服务端。

通过分析域名可以发现，这恶意域名 captcha.fm 解析到了 172.67.184.152 和 104.21.59.223，但是都是托管在 cloudflare 上，只能是反手一个举报了。

分析恶意账号
下载保存好恶意站点的源码后，我将情报发给了项目方团队，并开始分析这次钓鱼攻击的账号。由于我刚加入家人群，就收到了下面的这个地址发来的验证消息。经过分析，这个账号是一个伪装成 Captcha.bot 机器人的普通账号，当我加入到官方服务器后，这个假 Captcha.bot 机器人立刻从官方服务器私发我假的人机验证链接（看着像是自动化识别新加入的用户，自动构造链接并私发钓鱼链接），从而引导我输入钱包密码和助记词。

我在相关频道里面搜索了 Captcha.bot，发现有好几个假 Captcha.bot，于是将这几个账号也一并同步给了项目方团队，项目方团队很给力，也很及时地进行了处理（此时已是凌晨了），把这几个假 Captcha.bot 删除了，并一起讨论了可能的防范方式。

再次收到钓鱼链接
事情还没结束，第二天早上又一位慢雾的小伙伴（感谢 @Victory 提供素材）加入到官方 Discord 服务器中，再次收到恶意账户发来的私信，里面包含着一个钓鱼链接，不同的是，这次的钓鱼者直接伪装成官方的账户发送私信。

这次钓鱼者讲的故事是在链接中导入助记词进行身份验证，然而不是采用假小狐狸(MetaMask)的界面来欺骗用户，而是直接在页面上引导用户输入助记词了，这个钓鱼手法就没这么真（钓鱼手法太粗糙）。
钓鱼网站的域名和 IP 是 app.importvalidator.org 47.250.129.219，用的是阿里云的服务，同样反手一个举报。

钓鱼防范方式
各种钓鱼手法和事件层出不穷，用户要学会自己识别各种钓鱼手法避免被骗，项目方也要加强对用户安全意识的教育。
用户在加入 Discord 后要在隐私功能中禁止服务器中的用户进行私聊。同时用户也需要提高自己的安全意识，学会识别伪装 MetaMask 的攻击手法（比如查看是否有地址栏，如果是插件发起的是没有地址栏的），网页唤起 MetaMask 请求进行签名的时候要识别签名的内容，如果不能识别签名是否是恶意的就拒绝网页的请求。在参与 Web3 项目的时候无论何时何地都不要在网页上导入私钥/助记词。尽可能地使用硬件钱包，由于硬件钱包一般不能直接导出助记词或私钥，所以可以提高助记词私钥被盗门槛。
项目方团队也要时刻关注社区用户的反馈，及时在社区 Discord 服务器中删除恶意账户，并在用户刚加入 Discord 服务器时进行防钓鱼的安全教育。
Discord 隐私设置和安全配置参考链接：
https://discord.com/safety/360043857751-Four-steps-to-a-super-safe-account
https://support.discord.com/hc/en-us/articles/217916488-Blocking-Privacy-Settings-

Letture associate

GMO Legendary Prophet Shorts Again: AI Can't Save U.S. Stocks, Current Market as Dangerous as 2000

Jeremy Grantham, co-founder of GMO and renowned for identifying major market bubbles, warns that the current U.S. stock market resembles the dangerous conditions of 2000, arguing that AI hype cannot prevent a significant downturn. He emphasizes that high valuations historically precede difficult periods, not higher growth, and cautions that despite AI-driven enthusiasm, underlying economic challenges—including geopolitical instability, climate costs, and demographic decline—are being ignored. Grantham notes that while non-U.S. equities appear reasonably priced, the U.S. market is excessively valued. He compares today’s AI narrative to the internet boom of 1999, stressing that expensive markets eventually correct. His approach relies on value investing principles, avoiding overpriced assets and focusing on long-term fundamentals rather than market timing. Grantham also highlights structural market inefficiencies, such as the persistent outperformance of high-quality stocks, and criticizes the financial industry for promoting optimism despite clear risks.

marsbit24 min fa

GMO Legendary Prophet Shorts Again: AI Can't Save U.S. Stocks, Current Market as Dangerous as 2000

marsbit24 min fa

Where Is the AI Infrastructure Industry Chain Stuck?

The AI infrastructure (AI Infra) industry chain is facing unprecedented systemic bottlenecks, despite the rapid emergence of applications like DeepSeek and Seedance 2.0. The surge in global computing demand has exposed critical constraints across multiple layers of the supply chain—from core manufacturing equipment and data center cabling to specialty materials and cleanroom facilities. Key challenges include four major "walls": - **Memory Wall**: High-bandwidth memory (HBM) and DRAM face structural shortages as AI inference demand outpaces training, with new capacity not expected until 2027. - **Bandwidth Wall**: Data transfer speeds lag behind computing power, causing multi-level bottlenecks in-chip, between chips, and across data centers. - **Compute Wall**: Advanced chip manufacturing, reliant on EUV lithography and monopolized by ASML, remains the fundamental constraint, with supply chain fragility affecting production. - **Power Wall**: While energy demand from data centers is rising, power supply is a solvable near-term challenge through diversified energy infrastructure. Expansion is further hindered by shortages in testing equipment, IC substrates (critical for GPUs and seeing price hikes over 30%), specialty materials like low-CTE glass fiber, and high-end cleanroom facilities. Connection technologies are evolving, with copper cables resurging for short-range links due to cost and latency advantages, while optical solutions dominate long-range scenarios. Innovations like hollow-core fiber and advanced PCB technologies (e.g., glass substrates, mSAP) are emerging to meet bandwidth needs. In summary, AI Infra bottlenecks are multidimensional, spanning compute, memory, bandwidth, power, and supply chain logistics. Advanced chip manufacturing remains the core constraint, while substrate, material, and equipment shortages present immediate challenges. The industry is moving toward hybrid copper-optical solutions and accelerated domestic supply chain development.

marsbit26 min fa

Where Is the AI Infrastructure Industry Chain Stuck?

marsbit26 min fa

Autonomy or Compatibility: The Choice Facing China's AI Ecosystem Behind the Delay of DeepSeek V4

DeepSeek V4's repeated delay in early 2026 has sparked global discussions on "de-CUDA-ization" in AI. The highly anticipated trillion-parameter open-source model is undergoing deep adaptation to Huawei’s Ascend chips using the CANN framework, representing China’s first systematic attempt to run a core AI model outside the CUDA ecosystem. This shift, however, comes with significant engineering challenges. While the model uses a MoE architecture to reduce computational load, it places extreme demands on memory bandwidth, chip interconnects, and system scheduling—areas where NVIDIA’s mature CUDA ecosystem currently excels. Migrating to Ascend introduces complexities in hardware topology, communication latency, and software optimization due to CANN’s relative immaturity compared to CUDA. The move highlights a broader strategic dilemma: short-term compatibility with CUDA offers practical benefits and faster adoption, as seen in CANN’s efforts to emulate CUDA interfaces. Yet, long-term over-reliance on compatibility risks inheriting CUDA’s limitations and stifling native innovation. If global AI shifts away from transformer-based architectures, strict compatibility could lead to technological obsolescence. Despite these challenges, DeepSeek V4’s eventual release could demonstrate the viability of a full domestic AI stack and accelerate CANN’s ecosystem growth. However, true technological independence will require building an original software-hardware paradigm beyond compatibility—a critical task for China’s AI ambitions in the next 3-5 years.

marsbit44 min fa

Autonomy or Compatibility: The Choice Facing China's AI Ecosystem Behind the Delay of DeepSeek V4

marsbit44 min fa

Strategy Acquires 34,164 BTC In Largest Bitcoin Buy Since November 2024

Strategy, a major Bitcoin treasury company, has acquired 34,164 BTC for $2.54 billion in its largest purchase since November 2024. This marks the company's third-largest acquisition ever, funded through sales of its stock offerings. Following this purchase, Strategy's total holdings now stand at 815,061 BTC, representing 4.07% of the circulating supply. The company's average cost per Bitcoin is $75,527, bringing its portfolio to break-even after recent market recovery. Despite a bearish trend causing other firms to pause buying, Strategy continues to be the largest corporate Bitcoin holder. In related news, Bitmine, another treasury firm, has also been actively accumulating Ethereum, now holding 4.976 million ETH. Bitcoin's price is currently around $75,000.

bitcoinist58 min fa

Strategy Acquires 34,164 BTC In Largest Bitcoin Buy Since November 2024

bitcoinist58 min fa

How Blockchain Fills the Identity, Payment, and Trust Gaps for AI Agents?

AI Agents are rapidly evolving into autonomous economic participants, but they face critical gaps in identity, payment, and trust infrastructure. They currently lack standardized ways to prove who they are, what they are authorized to do, and how they should be compensated across different environments. Blockchain technology is emerging as a solution to these challenges by providing a neutral coordination layer. Public ledgers offer auditable credentials, wallets enable portable identities, and stablecoins serve as a programmable settlement layer. A key bottleneck is the absence of a universal identity standard for non-human entities—akin to "Know Your Agent" (KYA)—which would allow Agents to operate with verifiable, cryptographically signed credentials. Without this, Agents remain fragmented and face barriers to interoperability. Additionally, as AI systems take on governance roles, there is a risk that centralized control over models could undermine decentralized governance in practice. Cryptographic guarantees on training data, prompts, and behavior logs are essential to ensure Agents act in users' interests. Stablecoins and crypto-native payment rails are becoming the default for Agent-to-Agent commerce, enabling seamless, low-cost transactions for AI-native services. These systems support permissionless, programmable payments without traditional merchant onboarding. Finally, as AI scales, human oversight becomes impractical. Trust must be built into system architecture through verifiable provenance, on-chain attestations, and decentralized identity systems. The future of Agent economies depends on cryptographically enforced accountability, allowing users to delegate tasks with clearly defined constraints and transparent operation logs.

marsbit1 h fa

How Blockchain Fills the Identity, Payment, and Trust Gaps for AI Agents?

marsbit1 h fa

Trading

Spot

Futures