A while ago I found website ethersecret.com which turned out to be very interesting; it provides a search engine for ethereum private keys and their corresponding addresses and whether they hold any ether on them. The downside is that the odds of finding an address with transactions, let alone some eth in it are almost impossible because of statistics.
However, digging a bit I found that most of the the addresses within the first pages had transactions. So I decided to write a simple script to do some tests. The script transferred any incoming eth into these addresses, which some of them received almost daily.
Whenever a transaction came in it would be sent out to another address by a third party pretty much immediately, just 2 blocks after the eth arrived. And then I noticed:
Some of the accounts held some tokens, and a decent amount of them, but etherscan didn't show that these tokens held any actual value. I modified the script to see if I could use whatever eth that came into the account as gas to get the tokens out, but whoever was and is on the other side is faster and always takes the eth before any other transaction can take place and always outbids other transactions. So I eventually stopped trying to figure out what was going on.
Which is the weirdest thing, because the script that whoever was running always left the accounts in 0 balance, but now for whatever reason a tiny amount of eth is left in them.
My theory is that whoever was on the other side tricked people into sending eth to get these fake tokens out and their script was really good so they would extract all incoming eth at any cost. They used these private keys because they are actually "obvious", and now they are trying to bait even further.
I wonder if it could be the same people who wrote the ethersecret.com website.
Does anyone has any idea of what's actually going on with these "obvious" private keys?