There's an article floating around about Ethereum private keys, where people use "0x[...]0000" or "0x[...]0314" or what have you. You can check the corresponding public addresses on Etherscan and see funds being systematically siphoned out by the same few accounts.