Scam clusters.
Forensically mapped.

Large network of cloned forex/CFD broker sites built from one shared 'Trade Global Markets' marketing template.

749

domains

39

signals

Crypto-casino scam network built on one shared 'blockchain casino / take your free reward' platform.

362

domains

26

signals

Large fake-investment and fake-trading affiliate network of about 204 domains unified by one operator through shared Google Analytics and Google Tag Manager IDs. Shares operator tracking IDs with the Veltrix Markets cluster, marking it as the same operator's broader network; member alphastockinvestment.com carries a UK FCA warning.

219

domains

16

signals

TXEX is a Ponzi-style fake crypto exchange promoted through WhatsApp and Telegram 'mentor', 'coach' and 'crypto adviser' groups that drip daily 'trading signals' and promise ~100% returns. Victims fund an account they can never cash out: withdrawals are blocked behind a so-called 'release fee' that recovers nothing. New Zealand's FMA warned in April 2025 and tied 30 corporate entities and 813 duplicate websites to it, TXEX is the flagship brand of the ~$150M TXEX–DSJ scam-compound network (276 arrests).

159

domains

2

signals

Network posing as a Roblox 'scan / free Robux' service, rebuilt from a former fake 'world-class open source' crypto exchange.

103

domains

8

signals

DSJ Exchange (DSJEX) and its sister brand BG Wealth Sharing ran a $150M+ crypto Ponzi that promised 1.3–2.6% daily returns from fake 'AI trading signals', paying small early withdrawals to build trust. It faked a US SEC licence and, just before collapsing in April 2026, demanded a 12% 'tax' on balances, the classic Ponzi exit scam. It was named by 13 regulators across five continents (Philippines SEC, Australia's ASIC, Utah, Washington DFI, Tonga, Samoa…) and is the core of the TXEX–DSJ network.

65

domains

1

signals

Fake exchanges built on the 'buy crypto, sell & invest, pioneered the concept of seamless trading' template.

65

domains

13

signals

Multilingual network of fake 'AI-powered trading platforms' posing as official sites (EN/IT/FR/ES/NL/JA). Umbrella for the 'official website' copy beyond the four exact dom variants.

48

domains

3

signals

GROKR Exchange poses as an automated 'AI trading bot' platform promising 2–3% daily returns, recruiting victims through fake Facebook, Instagram and TikTok ads and profiles. Behind the facade it is a Ponzi (linked to the Wealth Win-Win Fund / W3F) that pays early users with new deposits, then blocks withdrawals and disappears in a sudden exit scam. It is unregistered and has drawn warnings across multiple jurisdictions.

45

domains

1

signals

UICEX (operated by CR Group LLC / CRGLOBAL) is a fake crypto exchange built on viral recruitment, simulated trading returns to early users and even meal reimbursements for recruiters, a textbook Ponzi where the 'trading' exists only to build trust before withdrawals are frozen. The NZ FMA warned on 7 July 2025; after exposure the operators rebranded it as 'Signal Raiders'. Part of the TXEX fraud-exchange network.

45

domains

0

signals

Crypto exchange clones with a 'buy & sell bitcoin, ethereum' headline and a swap / spot / margin / tournament / futures nav.

44

domains

6

signals

Forex/CFD scam sites all built on the commercial 'Cirro – Forex and Finance' website template (its shared asset/js signature across all 4 homepage designs). Using the same off-the-shelf kit ties the network together; combine with scam indicators before flagging.

43

domains

1

signals

Banking-themed websites sharing the same 'Simple, Quick, Secured' digital-banking template, page copy and interface across multiple DOM variants. Grouped by reviewed template evidence; shared code alone does not establish common ownership.

37

domains

6

signals

UZEX (uzex.com) is a fake crypto exchange the NZ FMA blacklisted on 25 April 2025 for operating unlicensed, market manipulation (pump-and-dump and wash trades) and fraud. Users report accounts banned for fabricated 'malicious activity' even after full KYC, and withdrawal requests that are never processed. It is named among the TXEX / League of Whalefall associated exchanges.

33

domains

0

signals

TPBit (tpbitax.com) is a crypto Ponzi pushed through WhatsApp referral groups advertising 'guaranteed', stable profits, where a small initial withdrawal is allowed to build confidence before deposits are frozen and 'fees' are demanded. New Zealand's FMA added it to its blacklist on 1 August 2025 as an unregistered, fraudulent entity, and victims report losses of $30,000+. It is one of the TXEX-linked exchanges.

32

domains

1

signals

OPT Coin (optcoin.com) is a fake crypto-exchange network that fabricates account balances and live 'profits', then blocks every withdrawal behind invented 'fees' and 'taxes'. It recruits through chat groups and influencers using fake testimonials and promises of guaranteed, unusually high returns, with no link to any licensed financial provider. NZ FMA-warned and unregulated; part of the TXEX fraud-exchange network.

32

domains

0

signals

Multi-language crypto futures exchange ('Dobibo*' brand family), futures, perpetuals and 'liquidity mining'; from a regulator fraud-platform list, now mostly defunct or phishing-flagged.

30

domains

0

signals

XUEX (xuex21.com) is a 'pig-butchering' fake crypto exchange that releases small early withdrawals to make victims feel safe, then blocks larger ones behind surprise 'fees' and 'taxes'. It carries an NZ FMA blacklist listing and shares the exact site template as PCEX and LWEX, marking it as part of the same scam network. Victims report missing BTC, ETH and USDT.

28

domains

0

signals

Network of fake Valorant 'free skins / skin giveaway' sites impersonating pro player TenZ (valoskins, tenzworld, tenzvalor, valodex…). Lures players with non-existent free skins to phish Riot credentials and hijack Valorant accounts. Sites are short-lived and rotate domains (.pro/.top/.com).

27

domains

1

signals

PCEX is a coordinated network of fake crypto exchanges that fabricate trading results and account balances, then block every withdrawal behind 'fees', 'taxes' or demands for further deposits. New Zealand's FMA blacklisted it on 25 April 2025, and it shares the same layout as XUEX and LWEX. The PCEX-branded pages have no affiliation with any licensed provider.

25

domains

0

signals

LWEX (lwex4.com) is a pyramid/Ponzi-style fake crypto exchange promoted across Telegram, WhatsApp, Facebook and Reddit with outsized profit claims, that secures an initial deposit then stalls withdrawals indefinitely. It has been flagged by New Zealand's FMA, France's AMF (June 2025) and Lithuania's central bank (April 2025), which called out its pyramid-scheme traits. It shares the PCEX/XUEX template.

25

domains

1

signals

ZZCOIN was the 'migration' brand of the TXEX / League of Whalefall Ponzi: investors were told to move their balance to ZZCOIN because of a fake 'government investigation', then charged a $400 'verification fee' under threat of losing their account. Its app was distributed outside the official stores (potential malware), and no investor is known to have withdrawn funds after paying. Part of the TXEX network.

24

domains

0

signals

IJEX (ijex.com) is a 'pig-butchering' fake crypto exchange with no regulator, a fake stock-photo 'team', empty company details and a 10/100 trust score. Scammers first build a fake romance or friendship over weeks via social media, dating apps or random texts, then steer the victim onto IJEX, a platform they fully control, where withdrawals are delayed or denied outright.

23

domains

0

signals

HelloBit is a 'click-a-button' crypto Ponzi: victims execute trades on bogus signals fed through the 'TSQ Investment Group' Telegram channel, while the operators domain-hop (hellobit.cc, hellobit8, hellobitese) to dodge takedowns. It was warned by New Zealand's FMA (April 2025) and Spain's CNMV (twice in 2025, as unauthorised to provide investment services). It is one of the TXEX-linked exchanges.

21

domains

0

signals

HHHE (hhhexp.com) is a multi-language crypto-futures exchange, futures, perpetuals, 'convert' and 'liquidity mining', from the same regulator-warned, TXEX-style fraud-platform network. Like its siblings it fabricates balances and live profits, then blocks withdrawals behind fees. The sites are now defunct or flagged by browsers as phishing/malware.

19

domains

4

signals

Trading scam kit built on the 'revolutionizing your digital trading experience' template.

18

domains

3

signals

Fake crypto exchanges built on the 'simplifies trading for a seamless, rapid and dependable experience' template.

18

domains

2

signals

Network of fake online banks and credit unions (e.g. globalinsurancebank, moderncreditunionplc, secured MCU, liberty-trustunion, biscreditgroup) sharing one banking template. Used in advance-fee / fund-recovery scams: victims are shown a balance 'held' in an account, then pressured to pay fees or 'taxes' to release funds that never arrive.

18

domains

1

signals

Crypto-exchange scam kit fronted by a live multi-pair price ticker (BTC/ETH/LTC alongside football fan tokens like PSG, Juventus, Atletico Madrid and Chiliz). Uses short random-code .it/.top domains and hides behind Cloudflare, which flags them as phishing.

17

domains

3

signals

CBEX (Crypto Bridge Exchange) was an AI-hyped crypto Ponzi that defrauded 250,000+ mostly Nigerian and Kenyan investors of an estimated $800M. It faked a decade of history and guaranteed 'AI trading' profits while quietly routing deposits out via the TRON network and laundering them cross-chain. It collapsed in April 2025 after Nigeria's SEC warning; the EFCC has since made arrests and issued further warrants.

17

domains

0

signals

Riscoin (aka 'League of Seagulls' / League of Seagull Ltd) is a copy-trading crypto Ponzi where fake 'crypto managers' promise unusually high, guaranteed daily returns through Telegram and Bonchat, while operators impersonate New Zealand banks and licensed firms to build trust. The Philippines SEC issued an advisory (12 Feb) and the NZ FMA warned; withdrawals are blocked behind extra 'fees' and 'taxes'.

15

domains

0

signals

Multi-asset broker scam kit pitching regulated-looking trust pages, 'who we are · licenses · security · solvency · affiliate program', across currencies, commodities, metals, stocks and indices. English-language sibling of the Russian 'Bilusevi' broker template; recruits through an affiliate program and blocks withdrawals once funded.

15

domains

1

signals

Cryptocurrency exchange websites sharing the 'Explore Crypto, Trade with Trust' template, a $1,111 bonus promotion and matching FAQ copy across four reviewed DOM variants. Shared template evidence does not establish common ownership.

14

domains

3

signals

Crypto exchange clones built on a 'buy crypto · markets · exchange · finance' template.

14

domains

2

signals

BG Wealth Sharing LTD, fake investment group calling itself 'the world's largest hedge fund', the front for the DSJ Exchange crypto platform. A 'click-a-button' app Ponzi that pays early members from new deposits; it ran ~12 months and collapsed in May 2026 after defrauding users of $150M+. Warned by 13 regulators across five continents (Canada, New Zealand, Tonga, Samoa, UK, Philippines, Utah, Washington) before the collapse; the operators rebranded the same machinery as Swift Wave and HQI. Operates many bg* / bgwealth* domains plus its own 'is it a scam?' alert sites. Other business names used: BG Wealth Group Inc., BGRE Capital Corporation, BG Wealth Group Growth Fund LP, BG Wealth Holdings Corporation, BG Wealth GP Inc., BG Wealth Properties Inc., BG Property Holdings Inc. (all found at bgwealthgroup.com) and Blackthorn Investment Group Inc.

13

domains

2

signals

Cluster of forex and CFD trading scam sites linked by a shared Google Analytics 4 ID (G-P6QBGXDK3N), pointing to one operator. The sites pose as regulated brokers and hedge-style investment platforms to solicit deposits with promises of guaranteed returns.

12

domains

1

signals

Fake 'SpaceX Token' presale sites on short spx*-style domains (spxwallets, spx30b, spcx90p, spx45k, spax33k): 'Early Access is Now Live', bonuses of up to 200%, payment in BTC/ETH/BNB/SOL/USDT and a countdown. Two tawk.to live-chat accounts are shared across the five. No affiliation with SpaceX.

12

domains

3

signals

Token-presale kit sold under eight letter-shuffled brands (Kaarden, Klardven, Klaxio, Cadwiin, Cdween, Kvaden, Cladven, Kadvun): every site opens on '[Brand] Official Token Presale, the first blockchain-enabled open-source purchasing platform for the real and virtual world' and hands out a referral code on arrival. All eight run the same tawk.to live-chat account and share two favicons. Distinct from Kradven Brokers (#158), whose kradven/klardwen sites are a broker login template, despite the look-alike names.

11

domains

1

signals

Crypto futures-exchange scam family using the yepbit* naming pattern.

11

domains

2

signals

Forex and managed-investment scam cluster sharing a common code template, marketing high-return currency trading and wealth plans while refusing withdrawals and demanding extra fees; wealthinvest24.com carries a British Columbia Securities Commission investor warning. wealthinvest24.com is still live while fx-ln.com fails to resolve.

11

domains

0

signals

Network of fake forex/CFD broker sites built on one shared 'Login to Webtrader, Welcome to the webtrader · your simple way to trade and learn' login template, fronted by invented brand names (ORBISOLYX, Pendoxa, Genesis Arbit, Grumblinion-Radiex, Possares-Renoyx, Quantiumax). Several are flagged as phishing; a classic fake-webtrader scam where a fabricated balance is shown but deposits can never be withdrawn.

11

domains

4

signals

68EA (68eaidn.com / 68ea-idn.com) is an advance-fee crypto-exchange scam that advertises high, 'risk-free' returns and aggressive referral incentives, then demands 'fees' or 'taxes' that never unlock a withdrawal. It appears on IOSCO's international I-SCAN alert list, having raised flags with securities regulators in several countries. The domains are now largely dead (parking / 'access denied').

11

domains

0

signals

Crypto scam kit built on a 'USDT storage center, anniversary' high-yield deposit theme.

11

domains

3

signals

Trading scam kit with a 20-language switcher and a 'home · quiz · faqs' nav.

10

domains

4

signals

Token-presale pages sharing a DOM fingerprint and GROK-themed presale copy. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

10

domains

2

signals

Fake crypto-exchange scam using the u6ex* naming family (u6ex.com/.net/.pro/.one/.today/.vip). An unregulated 'exchange' that fabricates account balances and profits, then blocks withdrawals behind advance-fee / 'tax' demands, flagged 1/100 trust by scanners and documented as a withdrawal-blocking crypto scam. Rotates TLDs as domains get flagged.

10

domains

1

signals

Crypto exchanges (coin* naming) fronted by a live BTC/USDT price ticker.

9

domains

2

signals

Investment scam brand (neqd*) that also operates its OWN fake review / 'is it a scam?' sites (.wiki 'tier S 4.9', -overview, -caution, -scam.com) to launder its reputation in search, the scam and its self-vouching review network share one operator.

9

domains

1

signals

Crypto scam family built on a '[brand]coin codes, transfer assets quickly and for free' template (*coin naming).

9

domains

2

signals

Fake 'AI trading platform | official website' sites (EN/IT/NL/DE dom variant #2 of the Cognivault family).

9

domains

1

signals

Multilingual (FR/EN) trading scam kit posing as an 'official website 2026' that promises to 'trade smarter' (Hong-Kong themed).

9

domains

2

signals

Italian-language fake AI trading platforms ('piattaforma di trading opera in modo più intelligente').

9

domains

2

signals

Greluna Exchange is an unregulated crypto-exchange scam (trust 1/100, no FCA licence) run as an advance-fee / pig-butchering scheme, fabricated balances and profits, then a 'withdrawal tax' to release funds that never arrive. Like the Neqd and Alithia networks, the SAME operator also runs Greluna's OWN fake review / 'is it a scam?' sites (greluna-scam.review, -caution, -reviews, -overview, -inspect, .wiki) to flood search results and vouch for itself. Reported as part of the NEOD Wealth scam network.

8

domains

2

signals

AI-investment scam brand (alithia*) using the same reputation-laundering kit as Neqd: the scam site plus self-run fake-review sites (.wiki 'tier S', -overview, -scam.com 'together against scams') that vouch for it.

8

domains

0

signals

Crypto exchange clones with *dex / *bit naming (benadex, celibit, lopebit, niledex…).

8

domains

1

signals

Italian mobile-themed scam kit ('5G 100%').

8

domains

1

signals

GoldBS Exchange (GoldBS Group Limited) is a fake crypto-investment platform run as a Ponzi: it lures victims with 5–10% 'guaranteed' returns, pays the first ones from new deposits to build trust, then blocks withdrawals once funded. Unregistered and unauthorised, the British Columbia Securities Commission added GoldBS Group Limited to its Investment Caution List (March 2026) and it appears on IOSCO's international investor-warning network; investors (notably in Pakistan) report failed withdrawals. The operator keeps spinning up new goldbs* domains as old ones get flagged or go offline.

8

domains

0

signals

Investment websites sharing reviewed variants of a blue trading-room landing page, centered investment copy and matching page sections. Grouped as a template family; common ownership is not established by the template alone.

8

domains

3

signals

Typosquatting network impersonating Hong Kong crypto exchanges (hkee / hkeex / hkitb / ganggujiao naming). Currently anti-bot-blocking scanners (403), template pending a reachable rescan.

8

domains

2

signals

Dutch/Belgian broker scam kit (shared 'contactgegevens · copyrights © alle rechten' footer).

7

domains

2

signals

PU Prime (Pacific Union, Seychelles), offshore forex/CFD broker network carrying multiple regulator warnings (UK FCA, Philippines SEC cease-and-desist, Danish FSA, IOSCO I-SCAN) despite an Australian ASIC entity. Operates puprime* domains plus the sister brand gxgfx (shared GTM container); blocked-withdrawal complaints.

7

domains

0

signals

Clones built on the 'global cryptocurrency exchange making crypto trading easier' template.

7

domains

2

signals

Websites grouped by an observed shared tracking identifier. Page designs vary; the identifier alone does not establish common ownership. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

7

domains

1

signals

Sisvida Exchange is a fake crypto-exchange scam posing as a 'leading global platform established 2019' (cold/hot-wallet separation, multi-signature, AI monitoring marketing). It shows fabricated balances and profits, then blocks withdrawals behind escalating fees and 'compliance' demands. Like the Greluna, Neqd and Alithia networks, the SAME operator also runs Sisvida's own fake review / 'is it a scam?' sites (sisvida-scam.com, -caution, -overview, -reviews, .wiki) to dominate search results and vouch for itself. Not yet on the FCA/DFPI/CFTC lists but carries the universal exchange-scam withdrawal-obstruction signature.

7

domains

1

signals

Russian-language broker scam kit ('о компании · лицензии · рынки').

7

domains

1

signals

Fake exchanges impersonating the real TradeOgre ('the original trusted crypto exchange' tagline).

7

domains

0

signals

Fake 'AI-powered trading platform – official website' sites (EN/IT/FR/NL/JA dom variant #3 of the Cognivault family).

7

domains

1

signals

Gamified trading scam ('invite · spot · swap · option game').

6

domains

1

signals

Websites grouped by observed tracking identifiers. A widely reused identifier also appears in other groups, so this association is ambiguous and requires further review. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

6

domains

0

signals

Fake investment/trading platform kit with a 'Platform [Brand]' hero over a purple-green world-map background and a 'Sign up now / Register now' form, used across several brands (Roca Crescore, Spot Exelon Xp, Aramco America Invest, Skywon FX). Collects sign-ups, shows fabricated balances, then blocks withdrawals.

6

domains

3

signals

Multi-country (Spain / France / Italy) AI-trading scam network using 'AI' and 'invest' branding plus Elon-Musk celebrity-bait sites (e.g. elonmuskaitrading.com). It hypes automated AI profits, then blocks withdrawals; the sites hide behind Cloudflare's WAF.

6

domains

2

signals

Six grok*-named crypto presale sites (grokvantage, grokvantis, grokvitrium, groklorum, grokprox, grokarium) each selling a 'GROK' token said to power xAI Grok integrations, an 'Autotrade AI reward engine' and AI marketplace payments, with up to 200% bonus tokens and a $500 minimum entry. The page copy differs per site, but all six run the same tawk.to live-chat account and three share one favicon, one operator behind six brands. Not affiliated with xAI.

6

domains

3

signals

Unregulated forex broker scam (capitalfinexmarkets, capitalpayinc) in the 'Finex' broker-scam family known for fake offshore regulation (Vanuatu / SVG / Mauritius) and forged licenses; the domains currently serve an empty LiteSpeed directory listing.

6

domains

1

signals

Crypto-exchange clone family using *bit / *crypt naming (bretebit, gardanbit, grantabit, malenbit, metbitex, portecrypt) built on one shared 'The most secure trading platform in the world' template with a fake mobile-app portfolio mockup and a staking / swap / P2P / buy-crypto nav. Markets competitive fees, then shows fabricated balances and blocks withdrawals.

6

domains

2

signals

Crypto scam kit using a 'scan the QR code to open' wallet gateway.

6

domains

0

signals

Russian forex scam kit built on a '1 month, no commission' offer (.pro domains).

6

domains

2

signals

Tofro Exchange is an unlicensed crypto-exchange/broker scam: victims report deposits they can never withdraw (ignored withdrawal requests, failed recovery) and a 1/100 trust score. It is blacklisted by the Bank of Lithuania (not authorised) and warned by the Netherlands' AFM (March 2025) as a likely boiler-room operation; it holds no top-tier licence (FCA, etc.). The operator keeps spinning up tofro* domains (.com/.me/.pro/.global/-usa) as older ones get flagged.

6

domains

0

signals

Crypto exchanges built on a 'markets · swap quick conversion · zero trading fees' template.

6

domains

1

signals

Fake mining dapps prompting 'connect wallet', wallet-drainer pattern.

6

domains

1

signals

Fake 'AI-powered trading platform | official website' sites (IT/EN/FR dom variant #1 of the Cognivault family).

6

domains

1

signals

Trading landing pages grouped by historical DOM variants, including the 934-euro and phone-form layouts. This group remains separate from the BeInveron and Italian template groups. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

6

domains

2

signals

Broker scam built on a shared 'create trading account / sign in' login template (equitros, knightpips).

5

domains

1

signals

Cryptocurrency landing pages sharing the Invest Smarter, Not Harder layout and a DOM fingerprint. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

5

domains

2

signals

Fake 'plataforma de trading con IA – sitio web oficial' sites (ES/FR/SK dom variant #4 of the Cognivault family).

5

domains

1

signals

VSTSA is a 'click-a-button' app Ponzi: promoters feed bogus 'trading signals' into an app where clicking a button does nothing, it simply recycles new USDT deposits to pay earlier investors. No real product or service, only promoter membership. Same click-a-button family as Grokr, Orbis Exchange and MTS Foundation; the site's source code is in Chinese and a sister domain (99w.one) defaults to Vietnamese (China/Vietnam ties). Uses vstsa* domains.

5

domains

1

signals

Crypto exchange clones built on a '[brand] exchange, secure crypto trading platform' template (*dex/*bit naming).

5

domains

1

signals

EU-focused scam kit built on a 'manage, analyze and optimize your crypto assets' template.

5

domains

0

signals

AI-trading / yield scam kit ('strategy · performance · security · risks', automated bots).

5

domains

0

signals

Websites grouped by historical tracking identifiers. Current page content varies, and the tracking association requires further review. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

5

domains

3

signals

Fake online trading-platform scam kit fronted by a dark 'sign in / Welcome Back' dashboard login across several brands (Algo X Trading, Motion Global Asset, Bitspectrex, Brokado Market). Victims are shown a fabricated balance and live positions, then withdrawals are blocked behind 'fees'.

4

domains

0

signals

Fake crypto exchange with an affiliate program and live coin prices (demetrixcoins, flofince).

4

domains

2

signals

French-language broker scam built on a shared login template ('se connecter · mot de passe · rester connecté'), across several brands (groupsecuritiesdublin, interface-arbitragecrypto, matignondeveloppement2).

4

domains

1

signals

Cluster of fake crypto operations spanning a bogus US Bitcoin-mining platform, an MEXC impersonation site, a yield-farming DeFi protocol that rug-pulled in mid-2025, and an AI crypto-trading exchange, all using deposit-then-block-withdrawal and advance-fee tactics. All four domains now return 404 or fail to resolve and appear defunct.

4

domains

1

signals

Finnish-language AI-trading scam network built on one shared template, '[Brand], #1 tekoälykaupankäyntialusta (AI trading platform), trusted by 50,000+ investors worldwide' with a 'Top Traders of the Month' leaderboard. Uses invented brand names (Brekutios, Kruvestal, Murvoxit, Senvix) on -official .co.uk/.org domains, targeting Finnish investors with fabricated profits before blocking withdrawals. Kruvestal is already flagged as suspicious; check the FIN-FSA warning list.

4

domains

2

signals

'Multiply' HYIP investment kit across two generations (invstechnet/techinvssmart + invsjadecptl/kslimitedinv), same 'Multiply' branding, multiple dom variants.

4

domains

0

signals

Pages grouped by matching content and DOM fingerprints. Limited captured content requires further review before drawing conclusions about their relationship. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

4

domains

2

signals

Indian 'Satta Matka' gambling network (Goa Satta) (goasatta, isladova, goa-satta.info, remnar-tech).

4

domains

0

signals

Single-operator fake crypto-exchange family using the frt* naming pattern (frtexc, frtexx, frtsss, frtvip) on one shared DOM template. No public reporting yet, characterized by the shared template plus sequential brandless domains; carries the universal exchange-scam withdrawal-obstruction signature.

4

domains

2

signals

Small forex broker scam cluster built on a shared site template promising guaranteed FX profits via personal account managers before locking deposits, with operators reportedly using fake first names. Both domains now return 404 and appear defunct.

4

domains

3

signals

Casino websites sharing the reviewed 'Stay Untamed' signup template, Zeus illustration, bonus section and page layout. Shared template evidence does not by itself establish common ownership.

4

domains

0

signals

Okoex is a fake crypto exchange that mimics the well-known OKX brand to borrow legitimacy, part of the regulator-warned, TXEX-style fraud-platform network. It lures users with high advertised returns and referral bonuses, then freezes accounts and blocks withdrawals behind fees. The platform is now largely defunct.

4

domains

0

signals

Fake crypto-exchange kit with a rotating hero ('Achieve financial freedom' · 'Start your token journey' · 'Build your crypto portfolio') above a live price-ticker table, used across several brands (moalawallet, zozotrade, dravan, Sisvida). Distinct from Portfolex Builders (#75). Shows fabricated balances/profits then blocks withdrawals.

4

domains

0

signals

Italian-language scam kit built on an 'automated AI investment platform for stocks & crypto' template ('piattaforma di investimento automatizzata basata su IA'). Part of a larger Italian AI-investment operator.

4

domains

2

signals

Crypto exchange kit built on a 'trade in a second · buy crypto express · Visa/Mastercard' template.

4

domains

1

signals

Digital-asset trading pages sharing a DOM fingerprint, market ticker and quick-buying interface. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

4

domains

2

signals

Multi-product HYIP/investment scam kit bundling forex, binary options, real estate, crypto-mining and bitcoin investing on one shared template.

4

domains

1

signals

Trading scam kit built on an 'access to all trading platforms · trade across mobile, web and desktop' template.

4

domains

1

signals

Shared broker login-portal template; some use Cyrillic look-alike characters to evade filters.

3

domains

1

signals

Fake crypto-exchange cluster marketed as digital-asset trading and staking platforms, with dckex.com documented as a pig-butchering-linked fraud using simulated order books, fake staking rewards and withdrawal-tax extortion, while fynor.com draws unwithdrawable-funds complaints. Both domains remain up behind Cloudflare.

3

domains

1

signals

Investment scam kit fronted by a large auto-translate language picker.

3

domains

0

signals

Broker pages sharing DOM and tracking evidence and displaying VT Markets branding. This record describes technical matches; it is not a finding of fraud or an independent verification of ownership. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

3

domains

3

signals

Exchange login pages sharing a DOM fingerprint, futures navigation and account interface. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

3

domains

1

signals

Multi-asset broker scam template ('global markets at your fingertips · one account, unlimited opportunities') (platinum-finance, wirezee-ltd).

3

domains

1

signals

Crypto-exchange impersonation cluster where mxcoin.com mimicked the real MEXC / mxc.com brand and tradingbloom.com operated as an unlicensed CFD and forex broker blacklisted by regulators in the Netherlands, Belgium, Italy, Estonia and Canada. Both domains now display domain-for-sale parking pages and the operation appears defunct.

3

domains

1

signals

Crypto scam kit (dep* naming) with a 'only uses .com/.org/.net, other extensions are fraudulent' private-access banner.

3

domains

2

signals

Rubybex (rubybexdwq.com) is a multi-language crypto-futures exchange, futures, perpetuals, 'convert', markets and 'liquidity mining', from the TXEX-style fraud-platform network. It displays fabricated returns to keep victims depositing, then blocks withdrawals behind fees. The domains are now defunct.

3

domains

0

signals

Trading account login pages sharing content and DOM fingerprints and Italian login and registration copy. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

3

domains

1

signals

Two near-identical multi-asset HYIP sites sharing the same Growing Wealth for Future Generations template, marketing fake crypto, forex, gold, oil and real-estate investment plans with implausible guaranteed returns of 80 to 555 percent over days. Both sites are still up and flagged with very low trust scores and shared-server scam clustering.

3

domains

1

signals

Cloned German-language sportsbook/betting sites (shared 'startseite · produkte · sport · ergebnisse · wettverlauf' nav).

3

domains

0

signals

Crypto 'contracts / market' scam family using the creatorcoy* naming pattern.

3

domains

1

signals

Pair of broker sites (blackbull.com, gainlit.com) sharing the same Google Analytics and GTM container, which points to common operation, likely one operator running two sites. blackbull.com is BlackBull Markets, a broker regulated in New Zealand and Seychelles; an earlier UK FCA warning was later withdrawn by the FCA. gainlit.com reuses the same analytics tags.

3

domains

2

signals

Crypto/forex scam kit built on a 'create your cryptocurrency portfolio today' template.

3

domains

3

signals

Pages sharing an Environment Safe entry screen and matching content and DOM fingerprints. A generic entry screen is weak evidence of an operator relationship. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

3

domains

2

signals

Trading registration pages sharing a DOM fingerprint, initial-deposit instructions and algorithm marketing sections. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

3

domains

2

signals

Crypto scam kit built on a '[brand] is a decentralised public blockchain' template.

3

domains

0

signals

Russian-language crypto/investment (HYIP-style) scam that rotates domains: the pages now show a 'our domain has changed, click to go to the new website' redirect notice. Uses profitia* and maxprof domains; consistent with the standardized scam-toolkit campaigns that mass-produce HYIP investment sites.

3

domains

0

signals

Investment-'consulting' kit built on one template, 'Truly ideal solutions for your financial growth · Helping clients attain new possibilities · Better investment, Better Results', under AgroChainExperts and Desuch Digital Assets, plus the German-language Prime Finance Limited whose scan text is poisoned by a GTranslate widget. One shared tawk.to support account.

3

domains

0

signals

JS-rendered scam sites sharing one page shell (short Asian-style code domains); the rendered template is hidden behind JS, pending a rendered-HTML rescan to characterize (likely casino/exchange).

3

domains

1

signals

Broker scam kit built on a 'navigate the markets · ride the waves of success' template.

3

domains

2

signals

Copy-trading and trading-signals scam ring marketing automated profit replication and charting tools across crypto, forex and stocks, with fabricated reviews and blocked withdrawals; procopytrade.com drew an FCA clone/unauthorised-firm warning. All three domains are now offline and appear defunct.

3

domains

2

signals

Fake crypto-exchange kit fronted by huge fake social proof ('289,966,330 USERS TRUST US', 'Why Choose Binunz?'), used across brands (Binunz, Bittfux). A deposit-lock scam: after depositing, victims can't withdraw and are pushed to 'deposit more to unlock'. Trustpilot is full of scam complaints; sibling MyBinunz.com is a documented scam.

3

domains

2

signals

Crypto-investment scam family built on one shared 'Start Investing in Cryptocurrency · 0% trading commission' template fronted by fake Bloomberg, Forbes and New York Times endorsement logos (bit-change.money, cryptonext.ru, vablueway.com). Markets easy crypto buying/selling and staking, then shows fabricated balances and blocks withdrawals.

3

domains

1

signals

Forex / binary-option trading scam built on a shared template (profitablefxoptiontrade.info, crestmdigital.com). Promotes 'profitable' fx/option trading with fabricated results; unregistered, with the usual deposit-then-blocked-withdrawal pattern.

3

domains

1

signals

Fake 'AI sniper bot' crypto wallet-drainer sites impersonating the 'Viper AI Sniper' brand ('AI-Driven Precision For Every Snipe', Solana token-sniping). They prompt victims to connect a wallet or run code, then drain it. Flagged malicious by multiple AV engines (wallet-drainer); brand-new throwaway domains.

3

domains

2

signals

Share/CFD broker scam kit built on a 'trade your favourite shares and CDFs · zero commission' template.

3

domains

1

signals

Trading scam kit shipping an un-edited default announcement bar + 'trading tools and analysis'.

3

domains

0

signals

Crypto-exchange scam kit built on a 'liquidity boosting platform, turn your tokens into more' theme; sites share one operator's live-chat fingerprint.

3

domains

1

signals

Owner-grouped scam network (zinderix, tuoparix, miloky) using short brandable '-ix/-ky' names. Pages are JS-rendered / blank at scan time and there is no public reporting yet, exact theme and template PENDING a rendered-HTML rescan to characterize. Grouped by the owner as the same operator.

3

domains

2

signals

Owner-grouped pair (vjc.cc, wjnos) sharing a DOM/content template; scan text empty, exact theme pending a rescan.

3

domains

2

signals

Pages with matching content and DOM fingerprints showing Where Winds Meet game content in stored captures. Shared or redirected third-party content does not establish common ownership. Snyfer uses this codename to identify the technical group; it is not the name of a verified operator.

3

domains

3

signals

Fake crypto exchange built on a shared template with a live price ticker and C2C / pledge / deposit features (crypto-orbit, cryptoorbit-web).

3

domains

2

signals

Multi-asset (stocks / crypto / ETF / indices) trading scam kit using versioned -v2/-v3 domains.

3

domains

0

signals