Watch Your Back

About this source

Watch Your Back is a security-research dataset out of cybersec-code on GitHub. It aggregates 17 sub-categories of BTC addresses associated with security incidents: Lightning Network channel-opening transactions, sextortion campaigns, ransomware payment endpoints, clipper-malware destination addresses, and an archived snapshot of BitcoinAbuse before it shut down. Each sub-category becomes its own source subkey (watchyourback:sextortion, watchyourback:ransomware, etc.) so filtering by attack class is one query.

How we got the data

Cloned from the cybersec-code/watchyourback GitHub repository. 17 sub-source directories walked, .tags rows parsed and ingested. ~480K addresses total.

Why this confidence

Varies by sub-category. Lightning openers (mechanical extraction from on-chain data) get 0.95. Ransomware and sextortion entries vary; some are first-hand victim reports, others are reposts from other feeds. Confidence per entry preserves the original dataset's per-entry annotation.

License & attribution

Permissive open-data license per upstream. We carry the original sub-source directory name as our subkey so attribution back to the dataset's curators is always one click away.

Largest sub-buckets

This source uses per-subkey rows so a single address page can distinguish, e.g., watchyourback:AntPool.com from watchyourback:F2Pool.com. Top 20 by row count:

Sample addresses

Up to 100 representative rows from this source, picked live from labels.db. Addresses appearing in the current rich-list snapshot are surfaced first, sorted by balance. Click any address to see its full /address aggregator entry.