One Contact, Many Scam Sites: Mapping 13 Fraud Networks Through Reused Operator Details

TLP:CLEAR · ScamMinder Research · Data as of 14 September 2026 · Updated 16 September 2026: network 3 recounted across all of its inboxes (23 → 28 sites) · Updated 27 October 2026: re-audited against the evidence ledger and urlscan.io, four statements corrected and a status update added (see the box below)

Scammers rebuild their websites every few weeks, but they keep reusing the same Telegram accounts, inboxes, crypto wallets, company numbers and site templates. Those leftovers connect sites that look unrelated. We traced them across 239 scam indicators and grouped them into 13 networks.

Key findings

• Operator reuse is the weak point. Reused contact details, wallets and company numbers tie together 143 scam sites. None of those links relies on hosting.
• Cloudflare fronts most modern kits. Every prediction-market clone, every fake wallet page and 64 of 71 invest-app sites sit behind Cloudflare's AS13335, which hides the origin server.
• Brand impersonation spans 16 countries. Three networks borrowed at least 43 real brands, led by US consumer names and Chinese manufacturers.
• The invest-app kit is still active. It produced 65 new sites between June and September 2026.
• Rotation beats blocking. Operators rotate top-level domains (.cc, .vip, .top, .baby) and random subdomains, so blocking one domain rarely ends a campaign.

Method: how websites are linked

Every ScamMinder analysis extracts identifiers from the captured page and its setup. These include messaging handles, contact emails, phone numbers, crypto wallets, company registration numbers, analytics IDs, name-server sets, hosting ASNs and a fingerprint of the page-builder template.

Each identifier type carries a different weight:

• Infrastructure is context, never proof. Shared hosting, certificates or name servers are attached to a network but never create a link on their own.
• A template fingerprint shows a shared kit. Kits are resold, so a match proves the same toolkit, not the same operator.
• An operator detail is the strongest lead. That means a wallet, private inbox, messaging handle or printed company number found on several scam sites and on no legitimate one.
• Noise is removed first. Placeholder phone numbers, WHOIS privacy services, domain-broker contacts and big-brand certificate names are marked as shared services and excluded.

The networks

1. Invest-app kit with Telegram support

Evidence: page-builder fingerprint · 71 scam sites · Nov 2025 to Sep 2026 · 64 on AS13335

This is the largest and most active family. 61 of the 71 sites run the same single-page "invest, mine or stake" app with a login-first layout and a Telegram support link. (Corrected 27 October 2026: the fingerprint has two markers, a Vite build and Telegram's web-app script, and ten of the matches are different pages that happen to share both, among them a crypto casino, an escort directory and a hosting provider. They stay in the indicator table as fingerprint matches, not as members of the kit.) Brand themes change freely, from oil companies to crypto exchanges to retailers: britishinvest[.]vip, apacinvest[.]net, triopetroleum-xof[.]com, binanceearn[.]vip, ozon-mart[.]com, orlenvip[.]vip, xn--maaden-kta[.]xyz, capricornenergypakistan[.]com, 45times[.]com.

Operators spin up random subdomains on the same base domains, such as idv5un[.]45times[.]com, qpjtzb[.]45times[.]com, xgvqab[.]trxbnb[.]com, 1qbjnq[.]trxbnb[.]com. The few domains with recorded registrars used Hong Kong and Singapore resellers.

2. "Brand + USDT" task and investment scams

Evidence: three shared contact inboxes · 34 scam sites · Mar 2024 to Jan 2025

Each site pairs a famous brand with a crypto or shopping suffix: starbucksvip[.]com, macysusdt[.]com, ai-nvidia[.]top, hermesparis-usdt[.]com, caterpillar-usd2025[.]com, electrolux-appliances[.]net, speed-redbull[.]com, meesho-mall[.]com, tcdd-usd[.]com. The scheme asks for a USDT deposit, gives the victim "tasks" or referral targets, and shows a daily income that can never be withdrawn. All 34 print the same three contact inboxes, one on a 888.com address and two on 163.com addresses, all first seen on the same day in March 2024. (Corrected 27 October 2026: an earlier version said one inbox.)

3. "Brand VIP" task scams

Evidence: 21 rotating free-mail inboxes · 28 scam sites · Jun 2024 to Jan 2026

This network runs the same playbook with numbered "VIP" domains: daikin8[.]com, yakult-vip[.]com, sony668[.]com, ubsvip888[.]com, heinekenvip888[.]com, oreo668[.]com, sanabilvip999[.]com, yili-trx[.]com, greevip[.]org, gdmining[.]com. Instead of one contact address it rotates 21 inboxes: twelve on Gmail, five on Yahoo, three on mail.ru, one on iCloud and one on a disposable-mail service (moakt[.]ws). A look-alike of Apple's mail domain (icould[.]com) and an internet[.]ru address appear on fewer sites. (Corrected 27 October 2026: an earlier version said most inboxes were on disposable or look-alike mail domains.) Each inbox appears on 14 to 23 of the sites, so the set only becomes visible when the inboxes are read together. Three random subdomains of 99lever[.]com joined the family in late 2025. The branding and timing overlap with network 2, which suggests a related operation.

4. Fake online shops on throwaway subdomains

Evidence: one support inbox on toysyork[.]com · 26 scam sites · Jun to Sep 2025

These stores use a random word as a subdomain of a cheap domain, mostly on .baby, .yoga, .fun and .website: gofit[.]hotwar[.]baby, iefox[.]noready[.]yoga, macfit[.]hockeyterm[.]fun, gofit[.]moviesie[.]website, itski[.]silverpop[.]baby, infear[.]nycdaily[.]blog. They show jumbled, repeated product listings at heavy discounts. Some subdomain labels repeat across parent domains (gofit, macfit, sixaim), which points to a generator script.

5. Prediction-market clones

Evidence: one company registration number · 15 scam sites · Jul to Sep 2026 · 15/15 on AS13335

This newest wave imitates crypto prediction markets ("Bitcoin up or down"): predora[.]cc, polymeet[.]cc, polyview[.]cc, x-predict[.]cc, polywox[.]com, predicter[.]cc, eventum[.]cc. All print the same registration number, and eight name the same claimed entity, "Forecast Harbor N.V.", to look regulated. A real company number belongs to one business, so finding it on a dozen fresh .cc domains is a strong indicator.

6. Fake "secure BSC" wallet pages

Evidence: one Telegram account · 12 sites (8 phishing, 4 scam) · 26 Dec 2025 to 2 Jan 2026 · 12/12 on AS13335

All twelve pages appeared within eight days, most on random six-character subdomains of two base domains: secbsc[.]com, 0xyfap[.]secbsc[.]net, evxnah[.]secbsc[.]net, vwqhp8[.]secbsc[.]com, zcbkid[.]secbsc[.]com. They pose as a Binance Smart Chain security checker and push visitors to connect a wallet or message "support" on the same Telegram account.

7. Rebranded mining, token and EV-charging schemes

Evidence: Telegram accounts and one deposit wallet · 22 scam sites · Jul 2024 to Apr 2025

• Magic-lime ran on nine top-level domains behind one Telegram contact and an inbox on magiclime[.]academy: magic-lime[.]io, magic-lime[.]top, magic-lime[.]christmas.
• Gust Mining (gustmining[.]pro, gustmining[.]app, gustmining[.]cc) and Keras Mining (kerasmining[.]com, kerasmining[.]me, kerasmining[.]cc) each rotated three domains behind one Telegram contact (two of those six records, gustmining[.]app and kerasmining[.]com, are now inactive in our database).
• Netotoken (netotoken[.]io, netotoken[.]net, netotoken[.]vip) shows the same crypto deposit wallet on every domain.
• A fake EV-charging "VIP" app (m[.]chargepoint-vip[.]com, ps[.]chargepoint-vip[.]com, app[.]dpusdt[.]cc) launched four sites in five days. It has no connection to the real ChargePoint.

8. Casino mirror domains

Evidence: Cyprus-format (HE) company number and affiliate mail domain · 6 scam and 21 warning · Mar to Sep 2026

A casino brand, "Mellstroy Casino", runs through look-alike spellings: mellgame[.]casa, mellgaming[.]com, melllgames[.]com, ggmell[.]com, mellgot[.]com, mellgamies[.]cc. All six scam-rated mirrors print the same Cyprus-format company number and the same affiliate mail domain (mellaff[.]com). They also share one Cloudflare name-server pair, which is context only: the same pair serves dozens of unrelated sites. Unlike the other networks, they are hosted outside Cloudflare, mostly on AS200514. (Corrected 27 October 2026: an earlier version counted the name-server pair as a link. The network is also much larger than these six mirrors; see the update box at the top.)

9. Smaller template kits

Evidence: page-builder fingerprints · 25 scam sites in four kits · Jun 2025 to Sep 2026

• "Vant" trading app: ten random-letter domains such as townsmall[.]com, cgbdedu[.]com, tpnpof[.]com, lykjhrb[.]com, all on Cloudflare and all carrying the same trade_web configuration. (Corrected 27 October 2026: an earlier version read the shared Cloudflare name-server pair as a sign of one account holder; that pair serves 76 sites in our ledger, including unrelated ones, so it is context, not a link.)
• "tm" task malls: tmzemart[.]com, tmrackia[.]com, tmdealbizz[.]com, uk[.]tmshophubx[.]com.
• "lmcd" mirror apps: m[.]lmcd[.]top, m[.]lmcd777[.]com, m[.]lmcd-irn[.]com, m[.]lmcd[.]it[.]com.
• AI and USDT kits: xp4qh8[.]supercomputer-ai[.]vip, geusdo[.]com, my6us[.]com, fndk02[.]com.

Infrastructure and geography

Tactics we saw repeatedly

Why handles, inboxes and wallets are not published. The exact Telegram handles, email addresses, wallets and company numbers stay in our internal records. Publishing them could expose people whose details were misused, and would tell operators exactly what we track. We share domain indicators only.

How to protect yourself

1. A brand plus "vip", "usdt", "mall" or a number in a domain is almost never the real company.
2. Support only on Telegram or WhatsApp is a red flag for any investment, wallet or shopping site.
3. A footer registration number is not proof of regulation. Look it up in the official company or financial regulator register, and check that the name and website match.
4. Deposit-first "tasks" or guaranteed daily income are the core of task scams. Real employers never ask you to pay to work.
5. Check any link before you pay. Paste it into ScamMinder. Every indicator below links to its full report.

Indicators of compromise

Domains are defanged (for example example[.]com) so they cannot be opened by accident. Each one links to the ScamMinder report for that site, not to the site itself.

Invest-app kit (Telegram support) (71)

Linked by: page-builder template.

"Brand + USDT" task scams (34)

Linked by: three shared contact inboxes.

"Brand VIP" task scams (28)

Linked by: 21 rotating contact inboxes.

Fake shops on throwaway subdomains (26)

Linked by: one support inbox.

Prediction-market clones (15)

Linked by: one company registration number.

Fake "secure BSC" wallet pages (12)

Linked by: one Telegram account.

Magic-lime investment sites (9)

Linked by: one Telegram account.

Mining, token and EV-charging schemes (13)

Linked by: Telegram accounts and one wallet.

Casino mirror domains (6)

Linked by: company number and affiliate mail domain.

"Vant" trading-app kit (10)

Linked by: page-builder template.

"tm" task-mall kit (6)

Linked by: page-builder template.

"lmcd" mirror-app kit (4)

Linked by: page-builder template.

AI and USDT kits (5)

Linked by: page-builder templates.

Accuracy and disputes

A shared detail is a lead, not a verdict. Network links are reviewed by an analyst before they appear on a report page, and a site that stops carrying the shared detail leaves the network automatically. If you run a site listed here and believe it was linked in error, you can dispute its report for free from the report page. Read more about how ScamMinder scores websites.