One Contact, Many Scam Sites: Mapping 13 Fraud Networks Through Reused Operator Details

TLP:CLEAR · ScamMinder Research · Data as of 14 September 2026 Scammers rebuild their websites every few weeks, but they keep reusing the same Telegram accounts, inboxes, crypto wallets, company numbers and site templates. Those leftovers connect sites that look unrelated. We traced them across 234 scam indicators and grouped them into 13 networks. 75,774 websites in the evidence ledger 300,966 evidence observations 188,736 distinct identifiers 234 scam indicators in 13 networks Key findings Operator reuse is the weak point. Eleven reused contact details, wallets and company numbers tie together 138 scam sites. None of those links relies on hosting. Cloudflare fronts most modern kits. Every prediction-market clone, every fake wallet page and 64 of 71 invest-app sites sit behind Cloudflare's AS13335, which hides the origin server. Brand impersonation spans 16 countries. Three networks borrowed at least 43 real brands, led by US consumer names and Chinese manufacturers. The invest-app kit is still active. It produced 65 new sites between June and September 2026. Rotation beats blocking. Operators rotate top-level domains ( .cc , .vip , .top , .baby ) and random subdomains, so blocking one domain rarely ends a campaign. Method: how websites are linked Every ScamMinder analysis extracts identifiers from the captured page and its setup. These include messaging handles, contact emails, phone numbers, crypto wallets, company registration numbers, analytics IDs, name-server sets, hosting ASNs and a fingerprint of the page-builder template. Each identifier type carries a different weight: Infrastructure is context, never proof. Shared hosting, certificates or name servers are attached to a network but never create a link on their own. A template fingerprint shows a shared kit. Kits are resold, so a match proves the same toolkit, not the same operator. An operator detail is the strongest lead. That means a wallet, private inbox, messaging handle or printed company number found on several scam sites and on no legitimate one. Noise is removed first. Placeholder phone numbers, WHOIS privacy services, domain-broker contacts and big-brand certificate names are marked as shared services and excluded. Figure 1. Each hub is one shared identifier or template, and each dot is one scam-rated website carrying it. Figure 2. The month each site was first analysed by ScamMinder. Bubble size is the number of sites. Older networks went quiet as newer kits appeared. The networks 1. Invest-app kit with Telegram support Evidence: page-builder fingerprint · 71 scam sites · Nov 2025 to Sep 2026 · 64 on AS13335 This is the largest and most active family. Every site runs the same single-page "invest, mine or stake" app with a login-first layout and a Telegram support link. Brand themes change freely, from oil companies to crypto exchanges to retailers: britishinvest[.]vip , apacinvest[.]net , triopetroleum-xof[.]com , binanceearn[.]vip , ozon-mart[.]com , orlenvip[.]vip , xn--maaden-kta[.]xyz , capricornenergypakistan[.]com , 45times[.]com . Operators spin up random subdomains on the same base domains, such as idv5un[.]45times[.]com , qpjtzb[.]45times[.]com , xgvqab[.]trxbnb[.]com , 1qbjnq[.]trxbnb[.]com . The few domains with recorded registrars used Hong Kong and Singapore resellers. 2. "Brand + USDT" task and investment scams Evidence: one contact inbox · 34 scam sites · Mar 2024 to Jan 2025 Each site pairs a famous brand with a crypto or shopping suffix: starbucksvip[.]com , macysusdt[.]com , ai-nvidia[.]top , hermesparis-usdt[.]com , caterpillar-usd2025[.]com , electrolux-appliances[.]net , speed-redbull[.]com , meesho-mall[.]com , tcdd-usd[.]com . The scheme asks for a USDT deposit, gives the victim "tasks" or referral targets, and shows a daily income that can never be withdrawn. All 34 print the same contact inbox. 3. "Brand VIP" task scams Evidence: contact inboxes including disposable mail · 23 scam sites · Jun 2024 to Jan 2025 This network runs the same playbook with numbered "VIP" domains: daikin8[.]com , yakult-vip[.]com , sony668[.]com , ubsvip888[.]com , heinekenvip888[.]com , oreo668[.]com , sanabilvip999[.]com , yili-trx[.]com , greevip[.]org . Its contact addresses sit on a disposable-mail service ( moakt[.]ws ), a look-alike of Apple's mail domain ( icould[.]com ) and internet[.]ru . The branding and timing overlap with network 2, which suggests a related operation. 4. Fake online shops on throwaway subdomains Evidence: one support inbox on toysyork[.]com · 26 scam sites · Jun to Sep 2025 These stores use a random word as a subdomain of a cheap domain, mostly on .baby , .yoga , .fun and .website : gofit[.]hotwar[.]baby , iefox[.]noready[.]yoga , macfit[.]hockeyterm[.]fun , gofit[.]moviesie[.]website , itski[.]silverpop[.]baby , infear[.]nycdaily[.]blog . They show jumbled, repeated product listings at heavy discounts. Some subdomain labels repeat across parent domains ( gofit , macfit , sixaim ), which points to a generator script. 5. Prediction-market clones Evidence: one company registration number · 15 scam sites · Jul to Sep 2026 · 15/15 on AS13335 This newest wave imitates crypto prediction markets ("Bitcoin up or down"): predora[.]cc , polymeet[.]cc , polyview[.]cc , x-predict[.]cc , polywox[.]com , predicter[.]cc , eventum[.]cc . All print the same registration number, and eight name the same claimed entity, "Forecast Harbor N.V.", to look regulated. A real company number belongs to one business, so finding it on a dozen fresh .cc domains is a strong indicator. 6. Fake "secure BSC" wallet pages Evidence: one Telegram account · 12 sites (8 phishing, 4 scam) · 26 Dec 2025 to 2 Jan 2026 · 12/12 on AS13335 All twelve pages appeared within eight days, most on random six-character subdomains of two base domains: secbsc[.]com , 0xyfap[.]secbsc[.]net , evxnah[.]secbsc[.]net , vwqhp8[.]secbsc[.]com , zcbkid[.]secbsc[.]com . They pose as a Binance Smart Chain security checker and push visitors to connect a wallet or message "support" on the same Telegram account. 7. Rebranded mining, token and EV-charging schemes Evidence: Telegram accounts and one deposit wallet · 22 scam sites · Jul 2024 to Apr 2025 Magic-lime ran on nine top-level domains behind one Telegram contact and an inbox on magiclime[.]academy : magic-lime[.]io , magic-lime[.]top , magic-lime[.]christmas . Gust Mining ( gustmining[.]pro , gustmining[.]app , gustmining[.]cc ) and Keras Mining ( kerasmining[.]com , kerasmining[.]me , kerasmining[.]cc ) each rotated three domains behind one Telegram contact. Netotoken ( netotoken[.]io , netotoken[.]net , netotoken[.]vip ) shows the same crypto deposit wallet on every domain. A fake EV-charging "VIP" app ( m[.]chargepoint-vip[.]com , ps[.]chargepoint-vip[.]com , app[.]dpusdt[.]cc ) launched four sites in five days. It has no connection to the real ChargePoint. 8. Casino mirror domains Evidence: Cyprus-format (HE) company number, one Cloudflare name-server pair, affiliate mail domain · 6 scam and 21 warning · Mar to Sep 2026 A casino brand, "Mellstroy Casino", runs through look-alike spellings: mellgame[.]casa , mellgaming[.]com , melllgames[.]com , ggmell[.]com , mellgot[.]com , mellgamies[.]cc . All six scam-rated mirrors share one Cloudflare name-server pair and an affiliate mail domain ( mellaff[.]com ). Unlike the other networks, they are hosted outside Cloudflare, mostly on AS200514. 9. Smaller template kits Evidence: page-builder fingerprints · 25 scam sites in four kits · Jun 2025 to Sep 2026 "Vant" trading app: ten random-letter domains such as townsmall[.]com , cgbdedu[.]com , tpnpof[.]com , lykjhrb[.]com , all behind the same Cloudflare name-server pair, which strongly suggests one account holder. "tm" task malls: tmzemart[.]com , tmrackia[.]com , tmdealbizz[.]com , uk[.]tmshophubx[.]com . "lmcd" mirror apps: m[.]lmcd[.]top , m[.]lmcd777[.]com , m[.]lmcd-irn[.]com , m[.]lmcd[.]it[.]com . AI and USDT kits: xp4qh8[.]supercomputer-ai[.]vip , geusdo[.]com , my6us[.]com , fndk02[.]com . Infrastructure and geography Figure 3. Hosting ASN for networks with recorded infrastructure evidence. Older networks, analysed before ASN capture existed, are omitted. Figure 4. Home country of each real brand named in a scam domain in networks 1 to 3, mapped by our analysts from the domain names. It hints at the audiences targeted, not at where the operators are. Country Brands Brand names used in scam domains United States 18 Macy s, Nvidia, Starbucks, Apple, Caterpillar, MGM, Blink Charging, Intel, ChargePoint, Omnicom, Doublemint, Colgate, Pringles, Oreo, Specialized, Fundrise, Amazon, IBM China 6 SAIC, Yinlu, Shineway, Supor, Yili, Gree Japan 3 Daikin, Yakult, Sony Italy 2 Enel, Azimut Yachts Türkiye 2 TCDD, Trendyol Saudi Arabia 2 Sanabil, Ma aden France 1 Hermès Netherlands 1 Heineken Denmark 1 Netto Sweden 1 Electrolux Switzerland 1 UBS Austria 1 Red Bull Poland 1 Orlen Russia 1 Ozon India 1 Meesho Thailand 1 Thai-Denmark Figure 5. Distinct hostnames across all 13 networks. Cheap and new endings are over-represented compared with the web as a whole. Tactics we saw repeatedly Domain rotation. One brand on many endings, such as magic-lime on nine TLDs and Gust Mining on three. Random subdomains. Six-character labels (secbsc) or word pairs (fake shops), so links can be swapped after each report. CDN fronting. Cloudflare in front of most sites hides the origin server and the real host. Borrowed legitimacy. Footer company numbers, "N.V." entity names and famous brand names on sites that have nothing to do with those companies. Off-site support. Victims are moved to Telegram, where the operator handles deposits and invents "withdrawal fees". Disposable contact. Temporary-mail and look-alike mail domains used as a site's only contact. Why handles, inboxes and wallets are not published. The exact Telegram handles, email addresses, wallets and company numbers stay in our internal records. Publishing them could expose people whose details were misused, and would tell operators exactly what we track. We share domain indicators only. How to protect yourself A brand plus "vip", "usdt", "mall" or a number in a domain is almost never the real company. Support only on Telegram or WhatsApp is a red flag for any investment, wallet or shopping site. A footer registration number is not proof of regulation. Look it up in the official company or financial regulator register, and check that the name and website match. Deposit-first "tasks" or guaranteed daily income are the core of task scams. Real employers never ask you to pay to work. Check any link before you pay. Paste it into ScamMinder . Every indicator below links to its full report. Indicators of compromise Domains are defanged (for example example[.]com ) so they cannot be opened by accident. Each one links to the ScamMinder report for that site, not to the site itself. Invest-app kit (Telegram support) (71) Linked by: page-builder template. Indicator (defanged, links to ScamMinder report) Trust score tangbi[.]top 10/100 safeminer[.]cc 10/100 jb[.]com 10/100 app[.]monetpay[.]io 10/100 cryptopath[.]app 10/100 apacinvest[.]net 10/100 britishinvest[.]vip 10/100 triopetroleum-xof[.]com 10/100 5188-gmig[.]top 10/100 binanceearn[.]vip 10/100 free-mining[.]top 10/100 gpnyrx[.]moonstakingpoker[.]one 10/100 lmino[.]moskes[.]net 10/100 665p[.]com 10/100 nnptj0[.]sca-mall[.]org 10/100 s[.]fundrise[.]cc 10/100 sasassets[.]com 10/100 ibmbsc[.]net 10/100 land[.]landofoff[.]com 10/100 3tree[.]vip 10/100 qomkex[.]trendyol-mall[.]biz 10/100 r[.]oilgrade98[.]com 10/100 w[.]usddoo[.]com 10/100 r[.]chargedup-port[.]com 10/100 stliym[.]bitomt[.]vip 10/100 ozon-mart[.]com 10/100 vjixup[.]amazon5[.]net 10/100 3tree[.]shop 10/100 gojilabs[.]top 10/100 velvex[.]club 10/100 orlenvip[.]vip 10/100 irrswap[.]com 10/100 qwe888-apex[.]com 10/100 metro12[.]shop 10/100 ai-bot-mining[.]top 10/100 capricornenergypakistan[.]com 10/100 trx[.]bot 10/100 pol568[.]com 10/100 adaweb3[.]net 10/100 flame-bat[.]com 10/100 xn--maaden-kta[.]xyz 10/100 cortexinvest[.]ai/register 10/100 5dz7qa[.]bnb-pulse[.]com 10/100 mviynr[.]qwe888-apex[.]com 10/100 ne8mrq[.]2017cleanenergycorp-cec[.]app 10/100 lknt[.]pro/9449e5 10/100 suiyizq[.]bond 10/100 coinbbb[.]top 10/100 lssc01[.]vip 10/100 14usd[.]com 10/100 web[.]ctpool[.]net 10/100 xzumgm[.]miniing[.]vip 10/100 mergedoge[.]com 10/100 vj0tcz[.]ozon-mart[.]vip 10/100 xgvqab[.]trxbnb[.]com 10/100 ghost0vps[.]com 10/100 iex7cm[.]cccfx[.]vip 10/100 w[.]global-trading-center[.]cc 10/100 1qbjnq[.]trxbnb[.]com 10/100 7jmsug[.]cpaminer[.]xin 10/100 idv5un[.]45times[.]com 10/100 qpjtzb[.]45times[.]com 10/100 r4eh8j[.]45times[.]com 10/100 avdabw[.]cccfx[.]vip 10/100 jet-up[.]ai 10/100 b[.]saudioil[.]net 10/100 s[.]internet-marketing[.]lol 10/100 tiashi[.]vip 10/100 sqwlkk[.]45times[.]com 10/100 aid-iran[.]vip 10/100 45times[.]com 10/100 Brand + USDT task scams (34) Linked by: one contact inbox. Indicator (defanged, links to ScamMinder report) Trust score azimutyachts[.]vip 10/100 macysusdt[.]com 10/100 gate-io[.]vip 10/100 saic-mall[.]com 10/100 gg-usdt[.]com 10/100 ai-nvidia[.]top 10/100 ttdk-usdt[.]com 10/100 ai-evbox[.]com 10/100 te-mall[.]cc 10/100 sscvip[.]cc 10/100 starbucksvip[.]com 10/100 applemall[.]top 10/100 iphonemall[.]vip 10/100 dnz-usdt[.]com 10/100 mgm-movie[.]com 10/100 blink-charging[.]net 10/100 netto-makemoney[.]com 10/100 netto-makemoney[.]net 10/100 wukong-vip[.]com 10/100 hermesparis-usdt[.]com 10/100 ai-intelcorporation[.]com 10/100 m[.]chargepoint[.]top 10/100 feevyp[.]com 10/100 lmshyx[.]com 10/100 danfuqiewu[.]com 10/100 daeornv-mall[.]com 10/100 vipspecialized[.]net 10/100 groupestore[.]net 10/100 electrolux-appliances[.]net 10/100 tcdd-usd[.]com 10/100 ai[.]usdenelx[.]com 10/100 speed-redbull[.]com 10/100 meesho-mall[.]com 10/100 caterpillar-usd2025[.]com 10/100 Brand VIP task scams (23) Linked by: contact inboxes. Indicator (defanged, links to ScamMinder report) Trust score daikin8[.]com 10/100 yinlu8-usdt[.]com 10/100 extra-usdt[.]com 10/100 shineway-mall[.]com 10/100 omnicom66[.]com 10/100 starbucksvip9[.]com 10/100 sanabilvip999[.]com 10/100 sony668[.]com 10/100 ubsvip888[.]com 10/100 supordq999[.]com 10/100 doublemintvip[.]com 10/100 bamatea9[.]com 10/100 yakult-vip[.]com 10/100 colgate66[.]com 10/100 thaidenmark-vip[.]com 10/100 unified11[.]com 10/100 tronlok-1[.]com 10/100 heinekenvip888[.]com 10/100 pringlesvip[.]com 10/100 oreo668[.]com 10/100 yili-trx[.]com 10/100 bvlgari568vip[.]com 10/100 greevip[.]org 10/100 Fake shops on throwaway subdomains (26) Linked by: one support inbox. Indicator (defanged, links to ScamMinder report) Trust score gofit[.]dotwest[.]boats 10/100 macfit[.]hockeyterm[.]fun 10/100 nowlog[.]myfederal[.]yoga 10/100 iefox[.]noready[.]yoga 10/100 gofit[.]hotwar[.]baby 10/100 maxbus[.]laarchive[.]yoga 10/100 gofit[.]moviesie[.]website 10/100 actcup[.]dotwebsite[.]baby 10/100 noman[.]oildomain[.]baby 10/100 sixaim[.]pizzaforum[.]baby 10/100 febink[.]atlantaair[.]org 10/100 sixaim[.]morepark[.]baby 10/100 macfit[.]chatlost[.]baby 10/100 orwant[.]angeljohn[.]fun 10/100 uslook[.]creditnow[.]baby 10/100 gofit[.]investtech[.]website 10/100 filmup[.]mdshare[.]website 10/100 infear[.]nycdaily[.]blog 10/100 viewdo[.]sellafter[.]blog 10/100 buyweb[.]emailnice[.]baby 10/100 heedge[.]hostnew[.]org 10/100 itski[.]silverpop[.]baby 10/100 asbus[.]liveshort[.]baby 10/100 artdo[.]happynude[.]fit 10/100 noload[.]htmlgross[.]baby 10/100 faxoil[.]nycmeet[.]baby 10/100 Prediction-market clones (15) Linked by: one company registration number. Indicator (defanged, links to ScamMinder report) Trust score predicate[.]cc 15/100 eventmex[.]xyz 15/100 predvek[.]top/event/bitcoin-up-or-down-1784970000 15/100 predicter[.]cc 15/100 polyxtrade[.]com 15/100 x-predict[.]cc 15/100 polywox[.]com 15/100 polycom[.]cc/markets 15/100 polyview[.]cc 15/100 polytip[.]cc 15/100 polymeet[.]cc 15/100 predora[.]cc 15/100 polycan[.]cc/profile 15/100 polycan[.]cc 15/100 eventum[.]cc 15/100 Fake secure BSC wallet pages (12) Linked by: one Telegram account. Indicator (defanged, links to ScamMinder report) Trust score 0xyfap[.]secbsc[.]net 10/100 6iuszy[.]secbsc[.]net 10/100 sdbros[.]secbsc[.]net 5/100 zcbkid[.]secbsc[.]com 5/100 9m9na7[.]secbsc[.]com 10/100 w2z32d[.]secbsc[.]com 10/100 ld5fix[.]secbsc[.]com 5/100 fsu7rg[.]secbsc[.]com 5/100 secbsc[.]com 10/100 ob9srs[.]secbsc[.]com 10/100 vwqhp8[.]secbsc[.]com 10/100 evxnah[.]secbsc[.]net 10/100 Magic-lime investment sites (9) Linked by: one Telegram account. Indicator (defanged, links to ScamMinder report) Trust score magic-lime[.]org 10/100 magic-lime[.]life 10/100 magic-lime[.]christmas 10/100 magic-lime[.]today 10/100 magic-lime[.]top 10/100 magic-lime[.]digital 10/100 magic-lime[.]io 10/100 magic-lime[.]info 10/100 magic-lime[.]site 10/100 Mining, token and EV-charging schemes (13) Linked by: Telegram accounts and one wallet. Indicator (defanged, links to ScamMinder report) Trust score gustmining[.]cc 10/100 gustmining[.]app 10/100 netotoken[.]vip 10/100 netotoken[.]io 10/100 gustmining[.]pro 10/100 kerasmining[.]me 10/100 kerasmining[.]com 10/100 ps[.]chargepoint-vip[.]com 10/100 ms[.]chargepoint-vip[.]com 10/100 m[.]chargepoint-vip[.]com 10/100 app[.]dpusdt[.]cc 10/100 kerasmining[.]cc 10/100 netotoken[.]net 10/100 Casino mirror domains (6) Linked by: company number and name-server pair. Indicator (defanged, links to ScamMinder report) Trust score mellgamies[.]cc 30/100 mellgot[.]com 15/100 melllgames[.]com 15/100 mellgaming[.]com 15/100 ggmell[.]com 15/100 mellgame[.]casa 15/100 Vant trading-app kit (10) Linked by: template and name-server pair. Indicator (defanged, links to ScamMinder report) Trust score townsmall[.]com 10/100 cgbdedu[.]com 10/100 tpnpof[.]com 10/100 lykjhrb[.]com 10/100 xytxhc[.]com 10/100 semdj[.]com 10/100 ayxynm[.]com 10/100 akekj[.]com 10/100 sesamsu[.]com 10/100 sdlckt[.]com 10/100 tm task-mall kit (6) Linked by: page-builder template. Indicator (defanged, links to ScamMinder report) Trust score tmrackia[.]com 10/100 tmzemart[.]com 10/100 tmdealbizz[.]com/app 10/100 tmdealbizz[.]com 10/100 tmtivshopr[.]com/app 10/100 uk[.]tmshophubx[.]com 10/100 lmcd mirror-app kit (4) Linked by: page-builder template. Indicator (defanged, links to ScamMinder report) Trust score m[.]lmcd-irn[.]com 10/100 m[.]lmcd[.]it[.]com 10/100 m[.]lmcd777[.]com 10/100 m[.]lmcd[.]top 10/100 AI and USDT kits (5) Linked by: page-builder templates. Indicator (defanged, links to ScamMinder report) Trust score geusdo[.]com 10/100 my6us[.]com 10/100 xp4qh8[.]supercomputer-ai[.]vip 10/100 nvokfe[.]supercomputer-ai[.]vip 10/100 fndk02[.]com 10/100 Accuracy and disputes A shared detail is a lead, not a verdict. Network links are reviewed by an analyst before they appear on a report page, and a site that stops carrying the shared detail leaves the network automatically. If you run a site listed here and believe it was linked in error, you can dispute its report for free from the report page. Read more about how ScamMinder scores websites .