40 Crypto Platforms, One Script?

Suspected Telegram-Driven Scam Network Built on Cloned Brands and Rotating Domains

Scam-Or Project received a comprehensive report via its whistleblower section alleging a coordinated ecosystem of roughly 40 crypto and investment platforms. The tipster says the operation uses Telegram and WhatsApp “mentors” to onboard targets, display staged trading gains, and then stop withdrawals by introducing a sequence of escalating fee demands.

Early checks already point to several domain clusters built on the same underlying blueprint: similar page structures, reused promotional storylines, and repeating content blocks. Taken together, these overlaps raise the likelihood of a centrally managed operation that keeps switching names and domains to preserve the funnel.

The Whistleblower’s Alert

A whistleblower reached out to Scam-Or Project and supplied a large Excel list identifying approximately 40 crypto trading platforms that allegedly follow the same fraud playbook. The submission frames them as a coordinated set of brands rather than unrelated one-off schemes.

According to the source, the platforms should not be viewed as separate projects but rather as elements of a coordinated syndicate. The structure allegedly allows operators to continuously extract funds from victims while maintaining activity by rapidly switching domains and brand identities.

Preliminary checks into several listed platforms—including:

• Prometheus Investment Alliance
• ProfitShock Investment Alliance
• LEXINOVA Trading Center
• Quantum Vault Trading Center

—immediately revealed major red flags. The websites display strikingly similar text modules, backend layouts, and behavioral patterns.

Key Findings: The Blueprint of a Coordinated Fraud

Based on the whistleblower’s documentation and our own early-stage review, the network appears to operate using a rigid and repeatable script:

1. Messenger-Based Social Engineering

Recruitment takes place exclusively within private Telegram and WhatsApp groups, presented as professional “trading communities” or “investment alliances.”

2. The “Mentor” Mechanism

Fraudsters impersonate seasoned analysts or professors. They walk victims through staged trades and instruct them to deposit funds into affiliated platforms.

3. Fabricated Trading Dashboards

Internal dashboards display rapid and impressive returns. These gains are entirely artificial—numbers manipulated to foster false confidence and emotional dependency.

4. Escalating Deposit Pressure

Once trust is established, victims are pressured to increase deposits. Any attempt to withdraw triggers sudden complications.

5. Advance Fee Extortion

Withdrawals are frozen until victims pay arbitrary charges labeled as:

• “Verification fees”
• “Tax obligations”
• “Compliance deposits”
• “VIP account upgrades”

Even after payment, funds are never released.

6. SEO Reputation Manipulation

The network appears to deploy systematic reputation management tactics, including:

• Automated spam review pages
• Manipulated “B1 Reviews” on hijacked domains
• Forum-style “success stories”

These materials are used within messaging groups as fabricated proof of legitimacy.

7. Shared JavaScript Loader Shell

A significant subgroup of web subdomains loads identical JavaScript-heavy placeholder pages featuring fallback messages such as:

“Loading resources”
“Please wait patiently”

8. Recycled “Investment Alliance” Templates

Several domains—including ProfitShock, Miqesia, Eramls, Acenix, Searel, Atrish, and Scatil—share nearly identical:

• Page architecture
• Navigation logic
• Marketing text blocks
• “Super Brain Lifeform” terminology

Analysis: Indicators of a “Scam-as-a-Service” Infrastructure

Overall, the indicators look less like a handful of isolated scams and more like a standardized, scalable fraud setup that can be replicated quickly across new domains and brand names.

The deployment of dozens of nearly identical websites points toward the use of white-label scam templates. These websites appear to operate primarily as visual trading simulators rather than real exchanges. The charts, bullish candle movements, and displayed account balances appear to be interface elements designed to create the illusion of profitable trading activity.

The so-called “Mentors” operate as psychological handlers, applying a method widely known as “Pig Butchering”—gradually building trust and fake profits over weeks before freezing accounts at the final stage.

Rotating Brands to Avoid Detection

A recurring pattern is rapid brand turnover:

• “Alliance”
• “Center”
• “Exchange”

This constant rebranding appears designed to outpace regulatory warnings and enforcement efforts. Certain platforms—such as Prometheus Investment Alliance—are already appearing in European fraud alerts, reinforcing the urgency of the whistleblower’s concerns.

Domains Grouped by Suspected Template Cluster

The following clustering reflects observable front-end similarities (design, wording, structure, navigation logic). It does not yet confirm common ownership.

Extended Observations

The key observation is not limited to visual similarity. The platforms also demonstrate consistent operational patterns in how information and functionality are presented to users, suggesting that the same template framework or development logic may be reused across multiple domains.

Many domains employ reusable trust-conversion components:

• Institutional-sounding brand names
• White paper references
• “Academy” and “Alliance” positioning
• AI and super-intelligence marketing language
• Rewards and participation incentives

Such rotating domains and re-skinned brands are common hallmarks of organized online investment fraud.

The whistleblower’s claims regarding coordinated search engine manipulation—such as strategically planted positive forum threads used inside Telegram groups—are plausible within this framework and warrant further evidence-based investigation.

At this stage, Scam-Or Project is not attributing these platforms to specific beneficial owners or legal entities. However, the website-level similarities are significant enough to justify a public warning and a structured evidence request.

Next investigative steps will focus on:

• Telegram and WhatsApp recruiter mapping
• Payment instructions and crypto wallet clustering
• Support contact overlaps
• Withdrawal obstruction scripts

WARNING: Protect Your Assets

If you are currently participating in a Telegram or WhatsApp group where a “mentor” directs you to trade on an unfamiliar platform:

Stop immediately.

Do not deposit additional funds.
Do not pay any “taxes,” “compliance fees,” or “withdrawal deposits.”

Legitimate financial institutions normally deduct applicable fees directly from the existing account balance. They do not require clients to send additional cryptocurrency or external payments in order to access or release their funds.

Any demand for an upfront payment to release your own funds is typically the final stage of the scam.

Call for Evidence

The scale described suggests that substantial sums may be flowing through this suspected network.

If you are:

• An investor
• A victim
• A former insider
• Or someone with technical knowledge of these domains

Your information is critical.

Please provide:

• Wallet addresses used for USDT or BTC transfers
• Chat logs and screenshots of “Mentors”
• Phone numbers or Telegram handles
• Newly identified domains with similar behavior

You may submit materials anonymously through the Scam-Or Project whistleblower section.

Comprehensive data collection is essential to map the full structure, issue targeted warnings, and assist authorities in tracing the operators behind these platforms.