⚠ Scam alert and transaction analysis
To be checked on request is a fake blockhead "i/thefrow-2 " on the Namecoin blockchain, minted on Friday 28th of January 2022 20:10:57 (GMT/UTC). The fake asset was sold for 10 ETH as vaulted asset on Ethereum, see further the
listing on LooksRare.
First trace
The analysis starts at
this (last) scam record of asset "i/thefrow-2 ". Then
toggling back to input 0 (click on the transaction, not on the address). As next step toggle forward to output 1 with the most relevant TxID to evaluate:
Here toggling forward output 0 leads to fake asset "i/myles-1 ", while toggling forward output 1
leads to an output of around 15 NMC. Here toggling forward output 1,
which is the name_new OP. This leads to the new transaction chain with UTXO of 93.30974648 NMC.
Toggling forward this UTXO leads to
the firstupdate of
u/atari.
Taking one split up of output 1 with 0.2 NMC leads to a recycling of several outputs
here and (with previous output 0) in the following
here. This ends at asset
id/kronos in the following transaction chain:
Opensea account namecoiner.eth is the only one who signed recently with "r", "0", "1" and "2" and he confirmed that this is his asset.
The main transaction chain of 93 NMC leads backwards
to an UTXO of 259 NMC evidently coming from an exchange.
Second trace
The side transaction chain of 15 NMC referenced in the first trace leads backwards to
a funds recycle with four inputs. Same transaction chain leads forward also to
this name_new OP. Output 0 leads to the firstupdate of asset
d/我是 and a transaction chain with countless renewals of Unicode assets, finally
to the nameupdate of asset
id/norðurljósahviða with data value
printingmoney420.bit, a known alt of namecoiner.eth.
The remaining output leads
to a funds recycle and output 0
to the name update of asset
i/adi-1. This was previously registered with value 2, like namecoiner.eth signs to identify his wallets. Toggling forward to UTXO 1 leads
to the name update of asset
u/greggindustries, which had previously been registered with value 1 as only namecoiner.eth does as well.
Checking the UTXO with 16 NMC
Account namecoiner.eth stated, the transaction chain mentioned above around 15 NMC would result from an UTXO with 16 NMC coming from a trade. While the statement was right, that it results from this UTXO, his further statement, this 16 NMC were transferred through an OTC deal with a third person is evidently wrong:
The 16 NMC UTXO leads forward directly
to one of the Gospel fragments. Toggling backwards from the 16 NMC UTXO leads
to this transaction. UTXO 0 from this transaction leads
to a Gospel fragment as well. It's unlikely for 99.99 % that a third person registered exactly
the same fragments of the Gospel of Mattew. Toggling back further from the UTXO with 16 NMC leads
to this transaction. From here toggling forward UTXO 0 leads
to a fake Punycode.
Forth trace
The first Gospel fragment mentioned before has been transferred to a transaction chain (possibly a different wallet) with a change of around 97 NMC. This leads toggling forward through countless unredeemed name_new OPs
to this transaction. The name_new OP leads
to asset
u/atari as previously traced. Toggling forward leads
to a funds split up. Output 0 leads
to this name_new OP, which leads
to asset
u/griffin, signed with "1" as it's usual for namecoiner.eth. This was another, even more direct trace between the fake assets and the known assets of namecoiner.eth.
Fifth trace
namecoiner.eth delivered another transaction to check, stating,
the 1 NMC input would come from a third person. But toggling one transaction back and one forward with UTXO 1 leads
to the same Gospel fragments mentioned before. Toggling further backwards leads
to the fake Twitter Egg "u/jonthepilot ". The scammer, who had sold the fake blockhead "i/thefrow-2 ", adapted this username for his
OpenSea account jonthepilot, holding the vaulted fake Egg.
Sixth trace
A further suspicious transaction was provided for analysis. Toggling forward leads
to the update of fake asset "d/xn--4tws85e ". Toggling the colored token of 0.01 NMC backwards leads
to this firstupdate transaction. Further backwards leads
to another transaction chain with an UTXO of 91 NMC. Backwards to the next redeemed name_new OP leads to the firstupdate d/flipme. Backwards leads
to a split up of 2 NMC.
A few blocks forward
a funds recycle leads
to asset
d/btc420, which is
vaulted by 👨✈.eth. Further asset of that transaction chain is
x/money, which is
vaulted by user 👨✈.eth as well. Here the UTXO of 93 NMC
came from an exchange. This transaction chain is not the same as the UTXO chain with 93 NMC of the first trace before.
Involved accounts
In summary, there is a high probability that the accounts listed below collaborated with each other in a coordinated way. Since these accounts are anonymous, multiple persons may be involved in the transaction chains. It should be taken in consideration that the transaction chains may be mixed by trades as well, eventually even performed on different blockchains. Whenever a transaction chain gets interrupted and a new chain of UTXOs appears, a trade made have been made as well.
On the other hand, it is very unlikely that the transaction chain starting with TxID
d4f14c32725dc24677867b5f5689fba878ce5938781a88f3d5ca3487d8158bad referenced in the first and second trace, which leads directly to two scam assets as well as to the known transactions of account namecoiner.eth, was interupted by any trade.
However, due to the number of traces, evidence was provided that all accounts listed below interacted with each other on the Namecoin blockchain:
A final conclusion was dependent from a plausible, traceable and verifiable explanation of the involved accounts, how to interpret the interactions with the scammer's wallet. Within a time frame of four weeks, the account namecoiner.eth was publicly unwilling and unable to provide such an explanation.
June 15, 2023
Uwe Martens
