How can scammers create an address that looks like yours?

[Becassine]

I've heard this story before about scammers creating an address that looks like yours and replacing it on the clipboard; I've just read a new one about X. How does this scam work? Do they target the victim first? I understand the result but not the process, so I'd like to understand (roughly speaking)

https://x.com/realScamSniffer/status/1894590726669045851

A victim lost $763,662 due to transaction history poisoning — copied an address matching first 4 + last 6 chars of the real address.

Victim:
0xf6b1539cc562c0ca5151825488eb8c3cdaf2b6e4

⚠️ Fake address:
0x804051B0cbc20443943C4F363573eF9bB7793375

✅ Legitimate address:
0x80404F3eb7fEd80349954e8285eC8A9365793375

There's an article (https://revoke.cash/learn/security/what-is-address-poisoning) but I didn't understand well 

[Charles-Tim]

That is address poisoning.

The attacker will send dust coin to the victim with the address that resembles the victims address. The victims will copy the address, thinking it is his own address and send coins to the attackers address.

This can happen if the victim is the only one sending coins to an address. The victim will think the deposit address is his. It can be the deposit address from an exchange. The attackers will generate address that is similar to it and use it to send dust to the victim sot they the victim can fall into the trap.

It is good to be aware of this and clipboard malware.

I do not know how the scammer created the address but I know it happening to those altcoins and not bitcoin.

[promise444c5]

The one you are asking for is a clipboard  malware while the one you quoted is address poisoning which is different although they have same purpose (to get the funds to the scammers address.

Address poisoning works more like a "dust attack" but instead of using it for tracking its used just to poisoning the history of the address by generating almost similar address with same prefix and suffix, so this will be in the history of the transaction of such victim, they do make their  findings and some tracking before attacking victim..

Clipboard malware on the other hand means your device is compromised with a hidden malware that could change any copied details on your Clipboard, thus without a proper cross check, victim could paste a wrong details and still make transaction thinkingit'sthe right one becausethey trust it  ..

--Always check your address from back to back before making any transaction it won't take you years to do

[PrivacyG]

The simplest way to explain it is they generate enough addresses until one is generated that has identical first and last public key characters.  But this is an automated process, it probably runs 24 out of 7 to generate as many coincidental addresses as possible so more victims can be screwed.

The malware then simply changes the address copied to your clipboard into the similar address generated by the scammer.  It would be ideal to never have an infected computer in the first place, but this is why it is advisable to spend a few more seconds on checking every single character of your address before pushing the send button.  It surprised me when I found out how many people seem to think a lot of money is worth the laziness of not checking 20 more characters to ensure the address of destination is correct.

[Catenaccio]

What are Address Poisoning Scams?
Address poisoning scams (Metamask)
Beware Of Address Poisoning Scams
Address Poisoning Attack, A Continuing Threat
SlowMist: Another Airdrop Scam, but with a twist

You don't need to know technically how scammers done that, but only need to know basic and be carefully to avoid their scams. When you have time, you can learn more about it technically but it's not too necesarry.

[cryptoaddictchie]

The simplest way to explain it is they generate enough addresses until one is generated that has identical first and last public key characters.  But this is an automated process, it probably runs 24 out of 7 to generate as many coincidental addresses as possible so more victims can be screwed.

So from my understanding theres a way to generate that kind of almost identical address? Im kinda curious about this one too since I dont know how they do it. Plus creating address in such wallet gives you random one.

Imagine how they can get the almost same address with that, probably there some software or scheme doing this. If there is one then they should have close it its being used by scammers as a mean to victimize a lot of newbies.

[Su-asa]

I do not know how they do those things because I don't know technical things about wallet that's why am kind of careful when making any transactions, I hardly send coin to someone, I prefer to send a fiat than valuable crypto asset. I do not save my address on my clipboard either because have noticed that when using and exchange sometimes address changes, so I prefer to go and copy the address than saving it on my clipboard.
We just have to be careful not to fall in such scams and losing our valuable assets to a scammer, so the links @Catenaccio provided would be helpful.

[BABY SHOES]

So from my understanding theres a way to generate that kind of almost identical address? Im kinda curious about this one too since I dont know how they do it. Plus creating address in such wallet gives you random one.

Imagine how they can get the almost same address with that, probably there some software or scheme doing this. If there is one then they should have close it its being used by scammers as a mean to victimize a lot of newbies.

Now the scammer can do identical with the same address as the target, I still don't understand address poisoning so can someone make a similar address?

I don't know if there is software that can create these addresses, maybe if there is it can be misused by scammers who will continue to deceive victims not only beginners but also target addresses that contain large funds.

[hugeblack]

Most often, such attacks are not random, but part of social engineering, so the less information is publicly available to you, the less likely such attacks will occur. In general, verifying the entire address takes only a few seconds.

[nc50lc]

The simplest way to explain it is they generate enough addresses until one is generated that has identical first and last public key characters.  But this is an automated process, it probably runs 24 out of 7 to generate as many coincidental addresses as possible so more victims can be screwed.

So from my understanding theres a way to generate that kind of almost identical address? Im kinda curious about this one too since I dont know how they do it. Plus creating address in such wallet gives you random one.

It's actually very simple, just "Bruteforce" and a bit of luck is all the hacker needs.
Bruteforce is the best method because the address is the "Keccak256" hash of the (x,y) pubKey pair of the prvKey, as of today, it's impossible to reverse that hashing algorithm.

Usually, they use a script that randomly creates private keys, derive the address, repeat until it produces a result that matches the first and last few characters or the target.
If it's just an Ethereum address's first four and last six characters (about 40Bits), it can be done with GPU(s) with a good chance of 1 out of one trillion.

[promise444c5]

I don't know if there is software that can create these addresses, maybe if there is it can be misused by scammers who will continue to deceive victims not only beginners but also target addresses that contain large funds.

I think vanitygen can do that
 A guide from 1miau https://bitcointalk.org/index.php?topic=5096373.0
This is only for Bitcoin besides there hasn't been any update on the repo for 13 years, there should be some open source vanitygen  tools out there too  though, you can make research to learn it.

[BABY SHOES]

I don't know if there is software that can create these addresses, maybe if there is it can be misused by scammers who will continue to deceive victims not only beginners but also target addresses that contain large funds.

I think vanitygen can do that
 A guide from 1miau https://bitcointalk.org/index.php?topic=5096373.0
This is only for Bitcoin besides there hasn't been any update on the repo for 13 years, there should be some open source vanitygen  tools out there too  though, you can make research to learn it.

I may have done that in the past with the desired costume address.
But I wonder if it works for Ethereum wallets as shown by the OP... the address is almost the same at the beginning and end.
This is not what I know yet with the creation of costume addresses in Ethereum.

[God Of Thunder]

This is only for Bitcoin besides there hasn't been any update on the repo for 13 years, there should be some open source vanitygen  tools out there too  though, you can make research to learn it.

If you are a Linux user, there is a forked version that you could try https://github.com/10gic/vanitygen-plusplus
People use this version because it is updated often.

Back to the topic, as hugeblack said, most of the time this is not a random attack but a part of social engineering.  Even if the hacker generates a look-alike address, it would take some time. They cannot instantly generate an address and inject it into your system.

At first, they target the victim and check where they send funds often. The hackers don't know where you will send your money. So, they find out the most frequent address generate a look-alike address, and then inject it into a victim's device, and then the scam happens.

[Showlove01]

Here are some evidence scammers can edit an address making it look like yours: Swapping letters, using the same write-up. Letter substitution, Number substitution, Special character manipulation. Using special characters to create a similar-looking address. Creating a domain name that is a mirror image of yours Creating a subdomain that appears to be part of your legitimate domain, Internationalized domain names.

[dkbit98]

I've heard this story before about scammers creating an address that looks like yours and replacing it on the clipboard; I've just read a new one about X. How does this scam work? Do they target the victim first? I understand the result but not the process, so I'd like to understand (roughly speaking)

Scammers are mostly using clipboard malware to slightly change addresses with their own, but user first makes a mistake by clicking some link and installing malware.
They probably have different methods for scamming, and it's easier to do it when using hot wallets or online wallets.
As a way of protection I would always double check addresses to confirm them, use Linux OS instead of wind0ws, and use hardware wallets.

[Findingnemo]

Most often, such attacks are not random, but part of social engineering, so the less information is publicly available to you, the less likely such attacks will occur. In general, verifying the entire address takes only a few seconds.

Even if we glanced at it twice or thrice we can't be completely sure about it unless we go through every character and remember it's case-sensitive. So it's better use QR codes if possible since there's no chance of making errors with that method.

Clipboard hijackers often bundled with the pirated software so one who downloads a paid app for free from a random website often inviting them a problem.

[Wonder Work]

I've heard this story before about scammers creating an address that looks like yours and replacing it on the clipboard; I've just read a new one about X. How does this scam work? Do they target the victim first? I understand the result but not the process, so I'd like to understand (roughly speaking)

Always be careful....

Scammers always use different techniques to create such traps. For this, we have to be constantly careful and before doing any kind of work, we must check them to see if there are any problems.

You must check the addresses before using them so that there are no problems. Scammers can match some parts of the address in the front and back but they cannot create your complete address. That is why I think it is safest to check the address before using it. Your money can be lost because of a small mistake, so if you check the address carefully before using it, the chances of losing money are less.

[Becassine]

Thanks for the links, I still have lots of stuff to read and new tabs open. It's crazy how many evil scams are out there, but it's also crazy that people are storing tens of thousands of dollars in hot wallets. There was a scam with the phantom wallet and the guy lost 63,000 dollars. He had used 12 words found under a Youtube comment ...

[promise444c5]

I may have done that in the past with the desired costume address.
But I wonder if it works for Ethereum wallets as shown by the OP...

Yeah it works for Ethereum address even solana and lots more , depending on the specific tool you're using, the repo Learn Bitcoin posted should work for 100+ cryptocurrencies as it was mentioned in their Basic Documentation, haven't tried it but I can still do it for learning purpose  .

If you are a Linux user, there is a forked version that you could try https://github.com/10gic/vanitygen-plusplus
People use this version because it is updated often.

Alright thanks for this, I will check this out as well.. I also saw some repos while researching but this is perfect.

[Jating]

Here are some evidence scammers can edit an address making it look like yours: Swapping letters, using the same write-up. Letter substitution, Number substitution, Special character manipulation. Using special characters to create a similar-looking address. Creating a domain name that is a mirror image of yours Creating a subdomain that appears to be part of your legitimate domain, Internationalized domain names.

It's not edit per se, the scammers might have been looking for a person address and that makes them their target, and as some explain the process it will took some processing power on their machine to create similar address as their target.

For Bitcoin, it's vanity address and we even have someone here to create one for us. That is for personal use only. But just like when we have tumblers which has a pros and cons, creating vanity address has the same as cyber criminals uses it as well to victimized unsuspecting crypto users as they have feel for this trap.