ScamIntelLogs is a passive OSINT archive of documented crypto scam operations — Telegram chats, admin panel artifacts, phishing infrastructure and IOCs — supporting authorized investigations and defensive research.
| Tool | phishdestroy/ScamIntelLogs — open-source intelligence archive of crypto scam operations, their chats, panels and indicators |
| Category | OSINT / threat intelligence evidence archive (HTML-based browsable collections) |
| Primary Use | Studying scam TTPs, tracing actor infrastructure via iocs.json, domains.txt and chat exports during authorized investigations |
| Safe Use | For security researchers, authorized threat intel teams, law enforcement and journalists conducting documented, lawful investigations and defensive research only — the project explicitly forbids harassment or vigilante use |
| Telemetry Note | As a passive archive it leaves no footprint on targets; defenders can consume its iocs.json and domains.txt feeds to enrich blocklists and detection rules |
ScamIntelLogs, published by the PhishDestroy collective at phishdestroy/ScamIntelLogs, is not a tool you run but an evidence corpus you read. The repository bills itself as an open-source intelligence archive of crypto scam operations, and the 416 stars it has gathered suggest the research community finds real value in that positioning. Written largely in HTML, the project ships a browsable front end via GitHub Pages alongside the raw directory structure, so analysts can either walk the evidence folders directly in the repo or use the visual archive browser. For professionals working fraud investigation or threat intelligence, this is the kind of dataset that fills the gap between vendor reports and the underlying primary material.
The core organizational unit is the collection — one directory per documented scam operation. The README currently lists fourteen: 717Team, BitXLucky, LuxardGambling, MercuryTeam, RublevkaTeam, TRXDrop, TheProject Casino, TheProject, TrustWalletPanel, WasabiSquad, gambler, keitaro, nicecrypto, and olympus-panel. Each collection preserves operational context alongside its artifacts, though contents vary significantly. Some teams have chat exports and payment records; others lean toward admin panel screenshots, domain lists, or machine-readable indicators. That heterogeneity is honest — the archive reflects what was actually collected rather than a forced uniform schema.
Internally, the directory convention is worth internalizing because it makes the corpus scriptable. A typical operation folder contains chat/ for internal Telegram group conversations, channel/ for public announcements, successful_thefts/ for confirmed theft records including wallet addresses and transaction hashes, designs/ for phishing templates and clone assets, and payments/ for affiliate payout logs. At the top level of each collection sit scammers_login.txt with participant Telegram identifiers, domains.txt with associated phishing domains, iocs.json as the machine-readable indicator set, and an index.html evidence browser. The iocs.json files in particular are the most automation-friendly artifact: they can be pulled into SIEM enrichment pipelines or cross-referenced against existing blocklists with minimal parsing effort.
The methodology section is unusually explicit for a project of this type, and it matters for anyone assessing the provenance of the data. The maintainers state plainly that they do not hack, bruteforce, or compromise systems; everything comes from passive intelligence gathering. That includes OSINT on public sources, community-submitted leaks from insiders, artifacts scammers exposed themselves through operational mistakes, passive monitoring of public channels and blockchain activity, and voluntary submissions from victims and researchers. Where admin panel access surfaced through leaks or misconfiguration, the project says it conducted non-destructive audits — documenting infrastructure without modifying it. An analyst citing this archive should still treat every artifact as unverified: the README itself warns the data is provided as-is without guarantees.
The README's usage guidance reads like a mini tradecraft manual for evidence handling, which tells you the intended audience is professional. Analysts are told to start with collection context, follow the artifact, and then record a reproducible reference — saving the repository path plus a commit link, and for blockchain evidence capturing the network, transaction hash, and a block explorer URL. The Y key permalink trick for GitHub file URLs is documented explicitly, which is a small but thoughtful touch: it means citations survive future edits to the archive. Cross-referencing against archived pages, public scans, and on-chain records is recommended as standard practice rather than optional diligence.
The keitaro collection deserves separate mention because it connects the archive to a broader infrastructure story. Alongside it, the project publishes a Keitaro TDS checker — a utility for researching traffic distribution system cloaking infrastructure, the redirect layer that separates bot and security-scanner traffic from real scam victims. TDS platforms like Keitaro are a recurring component of phishing and fraudulent gambling ecosystems, and having documented instances alongside the operations that used them gives researchers a rare end-to-end view: domain, cloaker, phishing kit, chat log, and payout trail in one place. The project also points to a separate repository, destroylist, for a consumable domain blocklist — that is the artifact defenders will want for direct blocking rather than research.
The stated beneficiaries are laid out in a table: security researchers studying scam TTPs and drainer mechanics, law enforcement building cases, journalists producing exposés, victims seeking attacker identification and recovery support, and threat intel teams doing actor tracking. The rationale for archiving at all is articulated around one observable reality — scammers systematically destroy evidence by deleting Telegram chats, burning wallets, and rotating domains. A git-backed archive with permalinks defeats that churn by ensuring a permanent record, enabling cross-operation pattern analysis on actors who reuse infrastructure, handles, and wallets. For an intel team, that longitudinal view is where the analytical value concentrates: a single operation is a curiosity, but fourteen operations with overlapping indicators form a dataset.
Handling obligations are taken seriously in the contribution and licensing sections, which is where a lot of comparable archives fall apart. Submitters must redact personal victim data before submitting, provide sources and handling notes, and propose clearly named directories when adding new operations. The use-conditions block states that the repository contains evidence of criminal activity for research purposes, prohibits harassment and vigilante justice, and flags victim PII for responsible handling. The license is mixed — MIT for the software components plus additional terms for the intelligence data — which the repo flags as NOASSERTION in GitHub metadata, so commercial reuse of the dataset itself warrants reading LICENSE carefully before incorporating it into a product.
Practically, working with the archive is straightforward for authorized users: clone or fork the repository, or browse the hosted archive and wiki directly. The Investigation wiki covers methods and resources including OSINT tooling, Telegram export handling, and blockchain tracing, which makes the project self-contained for analysts new to crypto fraud work. Evidence submissions flow through pull requests or the @PhishDestroy_bot Telegram contact, with SECURITY.md documenting the reporting process for security issues.
From a defensive perspective, the highest-leverage uses are indicator enrichment and pattern study. Ingesting iocs.json and domains.txt files across collections into threat intelligence platforms gives blocklists grounded in documented operations rather than speculative feeds. Analysts studying drainer mechanics or the social-engineering scripts visible in chat/ exports gain material for user-awareness content and detection engineering. The caveat bears repeating: treat attribution as evidence-supported, not proven, and keep all handling inside authorized investigative and research channels. Used that way, ScamIntelLogs is a genuinely useful public good in a corner of threat intelligence that is usually locked inside private vendor collections.
phishdestroy/ScamIntelLogs.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.