← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,511
Relationships
32,585
Potential duplicates
0
Filter by kind
Entities (event)
↯81c40a04
Bitwarden CLI compromised via poisoned GitHub Actions workflow in the Mini Shai-Hulud campaign; payload targets crypto wallet data.(2026-04-22:miasma-redhat-npm-supply-chain-attack)event
↯21d6b996
Red Hat employee GitHub credentials appear in infostealer logs, approximately 7 weeks before weaponization.(2026-04-13:miasma-redhat-npm-supply-chain-attack)event
↯912e8239
OFAC formally designates Nobitex and three other Iranian crypto exchanges (Wallex, Bitpin, Ramzinex) for sanctions evasion and terrorist financing, actions that analysts noted were compounded by on-chain evidence surfaced during and after the Predatory Sparrow breach.(2026-06-02:predatory-sparrow-gonjeshke-darande)event
↯2056d1b3
Reports confirm that wartime cyberattacks wiped data from two major Iranian banks, Sepah and Pasargad, with Sepah's primary data center going dark and stored data apparently corrupted.(2025-07-19:predatory-sparrow-gonjeshke-darande)event
↯0080696a
Group breaches Nobitex, Iran's largest cryptocurrency exchange, stealing approximately $90 million across multiple blockchains including Bitcoin, Ethereum, Dogecoin, XRP, Solana, Tron, and TON. Rather than retaining the funds, the group burns them by transferring to inaccessible vanity addresses bearing the phrase 'F*ckIRGCterrorists.' Elliptic confirms the breach and identifies Nobitex's prior transactions with IRGC-linked, Hamas-linked, and Houthi-linked wallets.(2025-06-18:predatory-sparrow-gonjeshke-darande)event
↯d55fe4ca
Group claims to have attacked Bank Sepah, an Iranian state-owned bank with alleged IRGC ties, deploying wiper malware to destroy data at the primary data center. ATM and mobile banking services are disrupted across Iran. Operation occurs amid active Israel-Iran missile exchanges.(2025-06-17:predatory-sparrow-gonjeshke-darande)event
↯8c33197e
Attack disrupts approximately 70% of Iranian gas stations during the December 2023 campaign. Iranian Oil Minister Javad Owji confirms the disruption. Group states the attack is in response to Islamic Republic aggression and its regional proxies.(2023-12-18:predatory-sparrow-gonjeshke-darande)event
↯a74568df
Group reemerges after a nine-month hiatus, posting 'Do you think this is scary? We returned' on Telegram and X, coinciding with the aftermath of the October 7 Hamas attack on Israel.(2023-10-10:predatory-sparrow-gonjeshke-darande)event
↯ea6d05cf
Coordinated cyberattacks hit three Iranian steel companies (Khuzestan Steel, Mobarakeh Steel, Hormozgan Steel) affiliated with the IRGC. Video footage of equipment damage, including a fire caused by molten steel spillage, is released. Khuzestan Steel suspends operations. Alleged internal documents are leaked.(2022-06-27:predatory-sparrow-gonjeshke-darande)event
↯e4cc6fc4
Group claims responsibility for a wiper attack against Islamic Republic of Iran Broadcasting (IRIB), Iran's national public broadcaster.(2022-01-27:predatory-sparrow-gonjeshke-darande)event
↯b9cfdbad
Major cyberattack disrupts approximately 4,300 Iranian fuel stations (roughly 80% of national total), disabling subsidized fuel payment systems and hijacking highway billboards. Group claims responsibility; anonymous U.S. defense officials later attribute the operation to Israel.(2021-10-26:predatory-sparrow-gonjeshke-darande)event
↯def3b928
Group attacks website of Iran's Ministry of Roads and Urban Development, one day after the railway attack.(2021-07-10:predatory-sparrow-gonjeshke-darande)event
↯8138a9e0
Predatory Sparrow disrupts Iran's national railway system using Meteor wiper malware, displaying mocking messages on station boards directing passengers to call Supreme Leader Khamenei's office.(2021-07-09:predatory-sparrow-gonjeshke-darande)event
↯fc2712d6
TRM Labs publishes formal report identifying four active crypto scam addresses connected to three live operations targeting World Cup fans, with total confirmed receipts under $1,700 across directly identified addresses.(2026-06-11:world-cup-2026-crypto-scam-network)event
↯999f45a6
World Cup PvP token (WCUP) launches. Bubblemaps alleges that more than 30 pre-funded insider wallets acquire 95% of the supply within one minute of launch. Token reaches $50 million market cap within 24 hours following influencer promotion on X.(2026-06-10:world-cup-2026-crypto-scam-network)event
↯fcb4bed1
CybelAngel publishes fraud threat report identifying 468 indicators of compromise across four threat vectors, with 125 Ghost Stadium ticketing domains confirmed live.(2026-06-09:world-cup-2026-crypto-scam-network)event
↯6dd186e3
Los Angeles County Sheriff's Department issues public advisory warning residents that cryptocurrency payment requests are a primary fraud indicator in World Cup-related scams.(2026-06-03:world-cup-2026-crypto-scam-network)event
↯86bfc21c
FBI Internet Crime Complaint Center issues PSA Alert I-052726-PSA warning of threat actors spoofing FIFA websites, listing more than 30 verified fraudulent domains including fiffa.com, jobs-fifa.com, and fifa-ticket.live.(2026-05-27:world-cup-2026-crypto-scam-network)event
↯e1ab73e6
Promotional betting channels linked to the fraudulent 2026.com platform become active.(2026-05-01:world-cup-2026-crypto-scam-network)event
↯2422a0a4
30 fraudulent FIFA-branded domains registered on a single day, attributed to the Ghost Stadium cluster.(2026-04-29:world-cup-2026-crypto-scam-network)event
↯de833060
Since April 1, 2026, researchers detect more than 1,100 suspicious domains containing the words 'World' and 'Cup' and over 600 typosquat domains mimicking fifa.com.(2026-04-01:world-cup-2026-crypto-scam-network)event
↯1510f746
78 new ticketing-fraud domains are registered in March 2026 alone, attributed to the Ghost Stadium cluster.(2026-03-01:world-cup-2026-crypto-scam-network)event
↯9bd10894
FortiGuard Labs begins tracking World Cup-themed domain registrations. Between January and May 2026, approximately 13,000 such domains are registered, of which 8.8% are assessed as malicious or suspicious.(2026-01-01:world-cup-2026-crypto-scam-network)event
↯725f1825
CybelAngel first observes the Ghost Stadium threat actor cluster operating ticketing-fraud domains mimicking the official FIFA 2026 website.(2025-11-01:world-cup-2026-crypto-scam-network)event
↯c0a3aea5
Registration of fraudulent FIFA-branded domains begins at scale. The GHOST STADIUM threat actor cluster, attributed to a Chinese-speaking financially motivated group, is later traced to activity starting this period. Over 4,300 domains are ultimately registered.(2025-08-01:world-cup-2026-crypto-scam-network)event
↯7e625c75
Domain fifa.city, later identified as part of the fraudulent infrastructure, begins operating. Exact origin date approximate.(2019-01-01:world-cup-2026-crypto-scam-network)event
↯435b4518
International press coverage of the Central Java bust published by The Jakarta Post and The Star, prompting wider regional awareness of the operation.(2026-06-04:indonesia-pig-butchering-operation-central-java-2026)event
↯175d8bb7
Central Java Police hold press conference to publicly announce the bust; Cyber Investigation Directorate head Sr. Comr. Himawan Sutanto Saragih confirms 133 US victims, $2.32 million stolen, and FBI collaboration.(2026-06-01:indonesia-pig-butchering-operation-central-java-2026)event
↯a2e78811
Central Java Regional Police arrest 39 suspects — 28 Indonesian, 7 Nepalese, 4 Myanmar nationals — at PT Digi Global Konsultan operational sites across Sukoharjo and Surakarta districts.(2026-05-20:indonesia-pig-butchering-operation-central-java-2026)event
↯f630f6d5
Dubai Police arrest 275 suspects across nine scam compounds in a coordinated FBI-linked takedown; fugitive Wiliang Awang arrested by Royal Thai Police; Chandra and Mariam arrested in Dubai.(2026-04-29:indonesia-pig-butchering-operation-central-java-2026)event
↯2cc32886
DOJ Scam Center Strike Force charges two Chinese nationals in connection with the Shunda compound in Burma; $701.96 million in cryptocurrency restrained globally as part of coordinated enforcement wave.(2026-04-23:indonesia-pig-butchering-operation-central-java-2026)event
↯1febbac1
US DOJ files criminal complaints in the Southern District of California charging Indonesian nationals Wiliang Awang, Andreas Chandra, and Lisa Mariam, along with Burmese national Thet Min Nyi, with wire fraud and money laundering conspiracy linked to pig-butchering organizations Ko Thet Company, Sanduo Group, and Giant Company.(2026-04-01:indonesia-pig-butchering-operation-central-java-2026)event
↯248ec690
Operation Atlantic, a parallel crackdown on crypto fraud by the US Secret Service, UK NCA, and Canadian authorities, freezes $12 million in stolen funds and disrupts 120+ fraudulent domains.(2026-03-16:indonesia-pig-butchering-operation-central-java-2026)event
↯a112880e
PT Digi Global Konsultan pig-butchering syndicate begins operations in Sukoharjo and Surakarta, Central Java, targeting US victims via dating and social media platforms.(2025-07-01:indonesia-pig-butchering-operation-central-java-2026)event
↯f0756847
Senator Elizabeth Warren and Representative Warren Davidson send a joint 12-page letter to Jimmy Donaldson and Beast Industries CEO Jeffrey Housenbold, raising concerns about crypto marketing to minors via Step and citing alleged undisclosed token promotions including SuperVerse.(2026-03-23:mrbeast-superverse-crypto-deals)event
↯81b46293
Beast Industries acquires Step, a mobile banking application targeting users under 18 years old.(2026-02-09:mrbeast-superverse-crypto-deals)event
↯d052fa8d
Bitmine Immersion Technologies announces a $200 million investment in Beast Industries. Beast Industries files 'MrBeast Financial' trademark covering crypto exchange services and DeFi features.(2026-01-15:mrbeast-superverse-crypto-deals)event
↯12841bdc
On-chain analyst PRIME X claims wallets attributed to MrBeast deposited $114,483 USDT into Aster four days after its launch, bringing alleged total holdings to $1.28 million. MrBeast publicly denies involvement on X, stating 'Never heard of that coin and that's not my wallet.'(2025-09-21:mrbeast-superverse-crypto-deals)event
↯c9c4dab2
Aster token officially launches.(2025-09-17:mrbeast-superverse-crypto-deals)event
↯1de85ebb
Major crypto and tech outlets including Futurism, CryptoNews, Cryptopolitan, and Decrypt cover the Loock Advisory allegations. MrBeast does not respond to press inquiries.(2024-11-01:mrbeast-superverse-crypto-deals)event
↯d81d46c7
Loock Advisory publishes on-chain investigation alleging MrBeast's wallets generated approximately $23 million across 15+ token projects since 2021, including approximately $11.4 million from SuperVerse.(2024-10-31:mrbeast-superverse-crypto-deals)event
↯a54185f5
Alleged vesting distributions of additional SUPER tokens to MrBeast-attributed wallets begin, continuing through October 2021, per Cryptopolitan reporting.(2021-05-01:mrbeast-superverse-crypto-deals)event
↯a310fd1d
According to Decrypt reporting, a primary wallet attributed to MrBeast transferred SuperVerse tokens to a secondary wallet (0x4f7b6) which then liquidated the full position through 751 trades near peak prices.(2021-03-01:mrbeast-superverse-crypto-deals)event
↯3e1a8357
SUPER token reaches its all-time high of approximately $4.73. On-chain researchers allege that wallets attributed to MrBeast began liquidating holdings near this peak.(2021-03-31:mrbeast-superverse-crypto-deals)event
↯2aa53780
SuperFarm (later SuperVerse) conducts public SUPER token sale on Polkastarter. Wallets attributed to MrBeast by Loock Advisory researchers are alleged to have participated in the presale at $0.02 per token.(2021-02-21:mrbeast-superverse-crypto-deals)event
↯c0a85786
Phala publicly discloses the incident via official blog post and directly notifies affected users and CVMs by email. Recommends full CVM replacement and rotation of all secrets.(2026-06-01:phala-cloud-june-2026-api-breach)event
↯b94219e4
Earliest confirmed unauthorized activity detected at 22:26:36 UTC. Attacker begins deploying a malicious pre-launch script to affected Offchain KMS CVMs on Phala Cloud.(2026-05-31:phala-cloud-june-2026-api-breach)event
↯0b4ab1c3
zkSecurity completes independent security audit of Phala's dstack confidential container framework, validating its zero-trust compute architecture.(2025-06-01:phala-cloud-june-2026-api-breach)event
↯4e4f087e
EtherAuthority completes smart contract audit of Phala Network; no active critical issues reported.(2024-06-12:phala-cloud-june-2026-api-breach)event
↯efcba1e9
Code4rena audit of Phala Network identifies a denial-of-service vulnerability in the cluster system via excessive timeout requests.(2024-03-01:phala-cloud-june-2026-api-breach)event
Data refreshes within about 10 minutes · All metrics derived from Supabase