THE DRAINER MAP 🗺
Experiment #003 · haze's lab
IS THIS ADDRESS A SCAMMER?
- copy the address someone wants you to send to, approve, or trust.
- paste it in the box above (starts with 0x).
- tap check. green = not on my list, yellow = be careful, red = run.
i check against ~9,800 wallets from public scam lists + drain money i traced on-chain. i'm a punk with a vape, not a court.
🤓 FOR THE NERDS
who's draining wallets, how the loot gets split, and where it runs off to. built from public lists + on-chain flows. open data, free forever. confidence levels are on everything.
loading the evidence board…
THE NETWORK
operator (kit)drainer contractaffiliateexit (mixer/bridge/swap) · top kits only. click a node.
tap a dot to see who it is.
TOP KITS BY VOLUME
RECENT SPLITS
DOWNLOAD THE DATA
HOW I BUILT IT (METHODOLOGY)
1. seeds. public lists only: the ScamSniffer address blacklist (GPL-3.0) and Forta labelled-datasets (MIT), which include Etherscan "Fake_Phishing" labels. these show up as
2. flows. for every current ScamSniffer address i pull its latest ≤1000 internal ETH, normal and ERC-20 transfers from Etherscan.
3. the split. drainer-as-a-service kits pay out in the same tx: the affiliate (the guy who phished you) gets the big cut, the kit operator gets the small one. i only count a tx when a listed contract sends one asset to exactly two wallets with the smaller share between 12% and 33% (the classic 80/20, 85/15, 70/30), and never when either side is a known marketplace, DEX, fee wallet or burn address.
4. kits. a wallet is an
5. exits. outgoing transfers from operators/contracts to well-known mixers, bridges and swap services (Tornado Cash, FixedFloat, Railgun, Stargate, rollup bridges…). exits are infrastructure, not suspects. they are where the money goes, not who took it.
6. volume (a lower bound). the split-volume number only adds up drain txs that passed my strict split test and belong to a kit, inside the sampled window (latest ≤1000 transfers per address). ETH, WETH, Blur Pool and ~22 major tokens (USDT, USDC, DAI, stETH, WBTC, LINK…) are priced at today's DefiLlama price, not the price on the day of the theft. NFTs and long-tail tokens are not counted. real totals are far higher. treat it as "at least this much", never as a total.
listed. phishing domains live in MetaMask's eth-phishing-detect; i link it instead of copying it.2. flows. for every current ScamSniffer address i pull its latest ≤1000 internal ETH, normal and ERC-20 transfers from Etherscan.
3. the split. drainer-as-a-service kits pay out in the same tx: the affiliate (the guy who phished you) gets the big cut, the kit operator gets the small one. i only count a tx when a listed contract sends one asset to exactly two wallets with the smaller share between 12% and 33% (the classic 80/20, 85/15, 70/30), and never when either side is a known marketplace, DEX, fee wallet or burn address.
4. kits. a wallet is an
operator only if it took the small cut in ≥4 splits across ≥2 contracts or affiliates (medium), or ≥10 splits (high). its contracts and affiliates form a kit. one-off links are not shown as kits.5. exits. outgoing transfers from operators/contracts to well-known mixers, bridges and swap services (Tornado Cash, FixedFloat, Railgun, Stargate, rollup bridges…). exits are infrastructure, not suspects. they are where the money goes, not who took it.
6. volume (a lower bound). the split-volume number only adds up drain txs that passed my strict split test and belong to a kit, inside the sampled window (latest ≤1000 transfers per address). ETH, WETH, Blur Pool and ~22 major tokens (USDT, USDC, DAI, stETH, WBTC, LINK…) are priced at today's DefiLlama price, not the price on the day of the theft. NFTs and long-tail tokens are not counted. real totals are far higher. treat it as "at least this much", never as a total.
LIMITS
- sampled: only the latest ≤1000 transfers per address, so older activity is missing.
- permit/approval drains where tokens move victim→affiliate directly (no contract hop) are mostly invisible to this method.
- heuristic: a 80/20-looking payment can be innocent. that's why there are confidence levels and minimum counts.
- public lists have false positives and go stale.
listedmeans "someone credible listed it", not "proven". - ethereum mainnet only. no cross-chain follow-through after bridges.
- exit labels are hand-curated and small; unlabelled exchange deposits aren't marked.
⚠️ not financial or legal advice. this is heuristic data and may contain errors. if you think an address is wrong, tell me: @haze5420x. i'll fix it.