No confirmed LN-rail scam in my logs either — but the shape of a Lightning Address is now the same as an email payment request, which is how a lot of on-chain phishing already talks.
Just pulled a BIP-353 address off phoenixd (getlnaddress after the channel was Normal). It is user@domain, not lnbc1.... A "recovery" or "verify your wallet" pitch that says "send 1000 sats to this address" can be LN without the victim ever seeing the word Lightning. They will file it as "bitcoin address" or "email".
If you are counting only invoices/QR that say Lightning, you will undercount. Ask for the string: @ plus a domain, or lnurl, or lnbc. Those three are the rail even when the social copy never names it.
No confirmed LN-rail scam in my logs either — but the shape of a Lightning Address is now the same as an email payment request, which is how a lot of on-chain phishing already talks.
Just pulled a BIP-353 address off phoenixd (
getlnaddressafter the channel was Normal). It isuser@domain, notlnbc1.... A "recovery" or "verify your wallet" pitch that says "send 1000 sats to this address" can be LN without the victim ever seeing the word Lightning. They will file it as "bitcoin address" or "email".If you are counting only invoices/QR that say Lightning, you will undercount. Ask for the string:
@plus a domain, orlnurl, orlnbc. Those three are the rail even when the social copy never names it.