spamreports

Huge shout to GiveETH, pcaversaccio and the rest of the seal911 crew

One Man Army Scores Big in Ethereum Security QF Round

Just wrapped up the Ethereum Security Quadratic Funding round on Giveth, and I’m thrilled with the results! My One Man Army project spamreports received $999.36 in direct donations — plus 1.3307 ETH from the matching pool (backed by a massive 638 ETH total).Huge thank you to everyone who donated, and especially to

GiveETH, TheDaofund, Quantstamp, and Wintermute for the strong support. Your belief in this work means a lot. This funding goes straight back into improving spamreports and some leisure activities Grateful for the boost onward! LFG!

Cloudflare, Vercel, and Netlify have all launched their own “Drop” services: upload a zip, get a live site instantly on their edge networks. Authentication and abuse protection? That’s for later. Right now it’s pure vibes.

This is peak industry brain rot. In a world already drowning in phishing, malware, and scam sites, these platforms just rolled out the easiest, fastest way for bad actors to host malicious content. Drag-and-drop phishing kits on workers.dev, instant fake login pages on Vercel, malware droppers on Netlify — all live in seconds with zero friction.

No real verification. No serious upfront checks. Just “move fast and let the internet clean up our mess." The hopium these web bros are smoking must be nuclear grade quality. They’ve spent years building trust in their platforms, only to turn them into free malware CDNs for anyone with a zip file.This isn’t democratizing the web. This is handing phishers and scammers the keys with a smile. Brilliant strategy, truly.

SCAM promoted via official SPACEX and STARLINK Accounts

SamCatmanRH waltzed in sporting official corporate bling like it just got promoted to Chief Rug-Puller.

This isn’t some shady blue check bought with Twitter Premium scraps. This is the premium, enterprise-grade, “we vetted you internally” badge. The kind of badge that should require blood oaths, multiple approvals, and a background check stricter than getting into a SpaceX clean room. Instead? It got handed out (or stolen) faster than free merch at a launch party. Moments later, the official @SpaceXAI and Starlink accounts were happily reposting $SCATMAN liquidity links like enthusiastic interns on their first day. Pump, dump, rug. Thousands of people got wrecked. Classic. And the best part? Crickets. As of this writing - a full day later - zero official statements from SpaceXAI, Elon Musk, Starlink, or anyone with a blue avatar and a corner office. No “we got hacked, here’s what happened,” no “lessons learned,” no “here’s how we’re preventing this from happening to your life savings next week.” Just… radio silence. The same crew that tweets about free speech absolutism and accelerating humanity’s future can’t be bothered to drop a two-sentence acknowledgment that their verified badge system is apparently as secure as a wet paper towel. This is the organization that wants to put humans on Mars, run Grok models smarter than most governments, and (presumably) handle actual mission-critical systems. Yet they can’t stop a catman from borrowing the corporate gold stamp to shill a Robinhood Chain rugpull. The optics are so bad they’re in orbit. Hey SpaceXAI comms team: Your silence isn’t strategic. It’s embarrassing. A quick “yeah, we got owned, badge system is getting audited, sorry not sorry” would at least show some balls. Instead we get the corporate equivalent of hiding under the desk hoping the internet forgets. The internet always wins these rounds. So here’s to the Gold Badge of Shame - shiny, expensive-looking, and apparently worthless the second someone wants to launch a scam. Maybe next time invest in actual security instead of just the branding. Or at least warn people before they click “Buy” on anything with that fancy badge. The universe is still waiting to be understood. Preferably without your verified accounts helping rug it first. - Snarkfully yours, Someone who expects better from the “understand the universe” crowd

Compromised accounts: Official

SpaceXAI (SpaceXAI / formerly xAI) and Starlink accounts on X were compromised. They reposted content from the SamCatmanRH account promoting the scam.Scam coin: $SCATMAN (also styled $scatman), launched on Robinhood Chain (scatman.dev). It was a meme coin that pumped hard (reportedly to ~$2M market cap) then rug-pulled.Scammer account:

Financial impact: Reports indicate the hacker(s) profited roughly $125,000 (via minting extra tokens and dumping). On-chain data shared in reports points to these wallets as linked to the dumper:

0xfee50d4ce48f2d05f520ce04c875647e4870a8ba

The fake MRBEAST casino saga continues

Confirmed fraud. Fake casinos for dumb idiots who believe a random fake casino will gift them 5400 dollars.

If you’ve seen a post from “MrBeast” claiming he’s launched a new cryptocurrency casino and is giving away thousands of dollars to anyone who registers—stop right there. It is a coordinated scam designed to drain your wallet.

The images look convincing. They use verified checkmarks and professional-looking web interfaces. But behind the curtain, it’s a classic “pig butchering” or “advance-fee” fraud.

How the Trap Works

The Bait: You see a “pinned post” or a profile link on X (formerly Twitter) or YouTube. It promises a massive reward (often $5,400 or more) just for signing up and using a promo code like MRBEAST.

The Hook: You register on a site like sugamb.at or beastcasino.net. Suddenly, your dashboard shows a massive balance. You think you’ve won!

The Twist: When you try to withdraw your “winnings,” the site tells you that you must first deposit real money to “verify your account” or “unlock” the withdrawal.

The Kill: Once you send your real crypto or cash, the scammers vanish. Your deposit is gone, and the “reward” balance—which was just a fake number on a screen—never existed.

The “Scam” Network

These sites are part of a massive, automated network. Scammers churn out dozens of these domains daily. Because they often share the same back-end infrastructure, your login credentials for one scam site will likely work on another. They are essentially digital clones designed to bypass platform bans.

The Blocklist

Avoid these domains (and any that look like them) at all costs. This is not an exhaustive list, but these are known malicious :

bemowin.com betaquaace.com botawin.com buafox.com buzawin.com caopux.com ceudex.com coahux.com coavox.com coawox.com couhex.com danewex.com darowex.com faokox.com fauwax.com fearwin.com feniwex.com feukox.com feuvax.com foapux.com foenox.com fuasux.com fuxowin.com gingobet.com gozawin.com guecax.com haemox.com harowex.com hasobin.com helawin.com hesobet.com huafux.com huesox.com huowux.com jaovex.com jaupux.com juzdex.com kaehax.com kaezax.com konawex.com kuofax.com leriwex.com madgamb.top morawex.com mozawin.com muocux.com noecux.com peupux.com poucex.com poutax.com reahox.com reakox.com redowin.com rexawin.com saohux.com semewex.com seuvox.com snugwin.com soafax.com soakwin.com sorewin.com soukax.com teuzux.com waucax.com woori.casino wuegox.com xwild.cc zenawex.com zeovux.com zoabux.com

Confirmed fraud. Fake casinos for dumb idiots who believe a random fake casino will gift them 5400 dollars.

If you’ve seen a post from “MrBeast” claiming he’s launched a new cryptocurrency casino and is giving away thousands of dollars to anyone who registers—stop right there. It is a coordinated scam designed to drain your wallet.

The images look convincing. They use verified checkmarks and professional-looking web interfaces. But behind the curtain, it’s a classic “pig butchering” or “advance-fee” fraud.

How the Trap Works

The Bait: You see a “pinned post” or a profile link on X (formerly Twitter) or YouTube. It promises a massive reward (often $5,400 or more) just for signing up and using a promo code like MRBEAST.

The Hook: You register on a site like sugamb.at or beastcasino.net. Suddenly, your dashboard shows a massive balance. You think you’ve won!

The Twist: When you try to withdraw your “winnings,” the site tells you that you must first deposit real money to “verify your account” or “unlock” the withdrawal.

The Kill: Once you send your real crypto or cash, the scammers vanish. Your deposit is gone, and the “reward” balance—which was just a fake number on a screen—never existed.

The “Scam” Network

These sites are part of a massive, automated network. Scammers churn out dozens of these domains daily. Because they often share the same back-end infrastructure, your login credentials for one scam site will likely work on another. They are essentially digital clones designed to bypass platform bans.

The Blacklist

Avoid these domains (and any that look like them) at all costs. This is not an exhaustive list, but these are known malicious :

7glint.com badogamb.com beacox.com boegux.com brugamb.com btogamb.com buafox.com buaregamb.com buzewin.com caagex.com caemux.com casiflow.cc casino.heodux.com ceudex.com cleangamb.com coin-casin.com coinvegaz.com crownroll.today crugegamb.com deonux.com epicstar.cc fasowin.com fearwin.com feastwin.com feowin.com foapux.com fuasux.com gambrex.com gaohux.com goefox.com grandvegas.digital guonex.com home.jaupux.com hugamb.at jastwin144.pro jercas.com kasowin.com koesux.com kwgamb.com lonixplay.com luzewin.com maorex.com masowin.com mbstplay.com merowin.com morgamb.com naewux.com naopux.com neazax.com nensen.org neohox.com noagax.com nuotox.com nuzewin.com pazewin.com pazowin.com crustwin.com plotygamb.com ponawin.com ponzobet.com puebax.com pugewin.com rackswin.com reakox.com rektwin.com rexawin.com serowin.com seuvox.com soafax.com soakwin.com space-stake.com stegamb.cc suzewin.com teuzux.com tezawin.com treyspin.com trumproll.net tucanbitcasino.com tustwin.com tuwagamb.com tuzawin.com ubeast.cc vlengamb.com wagerone.net wausex.com wcasx.cc wentgamb.com win2spin.net winbeaast.com winbeeast.com winbets.cc wspins.cc wspinz.cc zaogax.com zeadux.com zipcasino.casino zoekex.com zuadex.com zuosax.com

If you’ve seen a post from “MrBeast” claiming he’s launched a new cryptocurrency casino and is giving away thousands of dollars to anyone who registers—stop right there. It is a coordinated scam designed to drain your wallet.

The images look convincing. They use verified checkmarks and professional-looking web interfaces. But behind the curtain, it’s a classic “pig butchering” or “advance-fee” fraud.

How the Trap Works

The Bait: You see a “pinned post” or a profile link on X (formerly Twitter) or YouTube. It promises a massive reward (often $5,400 or more) just for signing up and using a promo code like MRBEAST.

The Hook: You register on a site like sugamb.at or beastcasino.net. Suddenly, your dashboard shows a massive balance. You think you’ve won!

The Twist: When you try to withdraw your “winnings,” the site tells you that you must first deposit real money to “verify your account” or “unlock” the withdrawal.

The Kill: Once you send your real crypto or cash, the scammers vanish. Your deposit is gone, and the “reward” balance—which was just a fake number on a screen—never existed.

The “Scam” Network

These sites are part of a massive, automated network. Scammers churn out dozens of these domains daily. Because they often share the same back-end infrastructure, your login credentials for one scam site will likely work on another. They are essentially digital clones designed to bypass platform bans.

Scammer wallet:

0x5a5F674447537C97C89D4CAC7427cDC8d861Ef71

DO NOT SEND ANYTHING HERE

YOU WILL LSOE YOUR ASSETS

The Blacklist

Avoid these domains (and any that look like them) at all costs. This is not an exhaustive list, but these are known malicious :

Same scam different name

If you’ve seen a post from “MrBeast” claiming he’s launched a new cryptocurrency casino and is giving away thousands of dollars to anyone who registers—stop right there. It is a coordinated scam designed to drain your wallet.

The images look convincing. They use verified checkmarks and professional-looking web interfaces. But behind the curtain, it’s a classic “pig butchering” or “advance-fee” fraud.

How the Trap Works

The Bait: You see a “pinned post” or a profile link on X (formerly Twitter) or YouTube. It promises a massive reward (often $5,400 or more) just for signing up and using a promo code like MRBEAST.

The Hook: You register on a site like sugamb.at or beastcasino.net. Suddenly, your dashboard shows a massive balance. You think you’ve won!

The Twist: When you try to withdraw your “winnings,” the site tells you that you must first deposit real money to “verify your account” or “unlock” the withdrawal.

The Kill: Once you send your real crypto or cash, the scammers vanish. Your deposit is gone, and the “reward” balance—which was just a fake number on a screen—never existed.

The “Scam” Network

These sites are part of a massive, automated network. Scammers churn out dozens of these domains daily. Because they often share the same back-end infrastructure, your login credentials for one scam site will likely work on another. They are essentially digital clones designed to bypass platform bans.

The Blacklist

Avoid these domains (and any that look like them) at all costs. This is not an exhaustive list, but these are known malicious :

11rolls.com 726354.click 7game.us 7oxbet.com 7riches.casino adinwin.com alfabets.cc antwood.bet aviatorfiled.cc axiscorevx.online bazowin.com bazowin781.pro beacox.com beast.camp beast.gifts beastgamb.com beastgames.bet beastx.cc beastxdice.com beawex.com begamb.at beowux.com besobin.com besowin156.pro betaquaace.com betasta.com betchoco.com betclub.cc betcube.cc betcube.top betepico.com betmeme.net betmigx.cc betnana.win betportal.pro betwintrack.com betxner.com betzynx.xyz binglbet.win blergamb.com blissogamb.com blizogamb.com bludgamb.com blygamb.com blyzes.live boacux.com boegex.com boegux.com bofgugamb.com bozawin.com broxus.tw btogamb.com buagux.com buaregamb.com buexgamb.com bugamb.at buopex.com buxegamb.com buxgamg.com bvixgamb.com caozax.com casewin.to casfox.com casiflow.cc casino-bets.me casinobonanza.casino casinocentr.com casiportal.cc casix.win caswox.com cazik99999.shop cazmax.com ccgamb.cc cebowin.com cenatplay.com cestwin.com chainspin.cc cleangamb.com coahox.com coavox.com cocawinz.com coin-casin.com coin-casino.me corexone.us crashboost.cc cretugamb.com crugegamb.com crustbet.com crustwin.com cryptobetwin.click cryptocasinox.pro cryptoslots.cc cuaregamb.com curagamb.com curhgamb.com cvelogamb.com cvixgamb.com dasowin.com deezbet.com deezwin.com deocox.com deojax.com doadox.com doagox.com doahux.com doavax.win doecex.com doufux.com drbet.win eclipsecasino.cc elegamb.com epicmoney.sbs etugamb.com eugamb.cc euroslots.io evixgamb.com faowox.com fasowin.com fastwin.casino fastwin1.com faufax.com fauwax.com fdsfsd.sbs feastwin.com feowin.com fernogamb.com flagmanship.online foegex.win fortbys.top fortunatenvt.top freesi.top fstdep.com fuokex.com fyrogamb.com gambamax.com gambet.best gambinx.com gambleeee.sbs gambrux.com gamburx.com gambux.com gamiros.com gengamb.cc gerspin.com gesowin77.pro getugamb.com globyx.net gmbeee.shop gmbeee.xyz go.deezwin.com go.heodux.com go.kaecex.com go.koazox.com go.neugox.com go.nuotox.com go.rackswin.com go.rexawin.com go.zaewex.com gobeast.bet goefox.com gogamb.at goodgamb.com goonbet.net gostwin.com goufax.com goxwin.com greencasino.casino guakox.com gunnogamb.com gvixgamb.com gyowin.com hasewin.com hasobin.com hasowin.com haxwin.com heodox.com

We usually think of phishing as a purely digital annoyance—spam emails, sketchy SMS links, or malicious DMs. But recently, crypto scammers have been getting desperate, reaching back in time to try an analog approach: snail mail.

Yep, physical letters arriving in your actual mailbox.

Likely fueled by a previous data leak, attackers initiated a massive, expensive physical mailing campaign targeting crypto holders. The bait? A highly convincing letter prompting the victim to scan a QR code to secure their hardware wallet.

You can check out what the physical bait looked like from this user who received one in the mail

FAKE WEBSITE

The Scam Flow

The mechanics were pretty straightforward:

The Bait: Scan the printed QR code (qr[.]c-6542[.]cc).

The Trap: Get redirected to secure[.]portal-coldcard[.]com.

The Steal: The site acts as a seed phrase stealer. If you punch in your recovery phrase, your wallet gets drained immediately.

The Takedown (or, Why Analog Phishing is a Terrible Idea)

Here’s where it gets fun. I started investigating the infrastructure behind this trap. The scammers thought they were being incredibly slick by hiding their backend behind Cloudflare. But with a bit of digging, I managed to unmask the real hosting provider (spoiler: it was BL Networks).

Once I had the real infrastructure pinned down, managed to get the campaign blocked

As a reminder: Never, ever type your seed phrase into a website. Not even if a very official-looking piece of paper arrives at your house telling you to do it.

Stay safe out there!

Indicators of Compromise (IOCs)

QR Code Redirect Domain: qr[.]c-6542[.]cc

Seed Phrase Stealer Domain: secure[.]portal-coldcard[.]com

Hidden Host (Unmasked): BL Networks

ASN: AS399629

Regs NICENIC and CNOBIN

Fake malware hosted directly on GOOGLEs servers - no problem.

The Call is Coming from Inside the House: When Alphabet Becomes the Malware CDN

Let’s take a moment to marvel at the sheer, unparalleled cybersecurity juggernaut that is Alphabet.

Here is a company with effectively infinite resources. They own Google Safe Browsing, the very shield that protects billions of users from the dark corners of the web. They own VirusTotal, the world’s premier malware scanning and threat intelligence database. They even dropped $5.4 billion to acquire Mandiant, basically buying the Avengers of incident response. Add in planetary-scale telemetry, and you’d think their own backyard would be the safest place on the internet, right?

Wrong.

Instead, threat actors are comfortably kicking back and using Google Cloud Storage as their personal, high-speed, highly reliable Content Delivery Network for malware.

Case in point: A wildly obvious Gate.io phishing clone. The cybercriminals didn't even have to work hard to find bulletproof hosting. They just spun up a bucket on Google's infrastructure and hosted their malicious payload directly at https://storage.googleapis[.]com/aicoin/Gate-x64.zip.

Let that sink in. The company that scans your Gmail for suspicious attachments, flags dodgy domains in Chrome, and literally owns the platform where the entire infosec industry uploads malware samples to be analyzed... is actively hosting the malware. It’s sitting right there on their own premises.

The payload itself isn't even trying to hide. Run it through a sandbox, and it lights up like a Christmas tree: persistence mechanisms, dropped DLLs, location checks—the whole nine yards of a classic crypto-stealing or remote access trojan setup.

It is profoundly unacceptable that a tech empire with billions of dollars and the world’s most advanced threat-hunting capabilities can't seem to police its own basic storage buckets. We are constantly lectured by big tech about "zero trust" and "advanced persistent threats," yet they can't even stop a generic phishing campaign from using their own domains to bypass security filters. (Because hey, who blocks googleapis.com, right?)

Microsoft’s GitHub was compromised because an Microsoft employee using Microsoft VSCode installed a rogue extension from Microsoft’s own VSCode extension library. Which is moderated and hosted by Microsoft themselves.

Maybe it is time to revisit their approval strategy, exactly as the microsoft store which previously served phishing Ledger wallet. As Microsoft owns npm - between npm, VS Code, and github, Microsoft is possiubly among the largest distributors of malware, cool.

Nx Console (nrwl.angular-console) v18.95.0, a VS Code extension with 2.2M+ installs, was published with malicious code on May 18, 2026. The compromised version executes an obfuscated credential stealing payload on workspace activation.

Scam X Coin Presale

Fake garbage on Twitter / X

🚨 SCAM ALERT: The "X Token Presale" is a Fake

Scammers are currently using verified handles to promote a fake "X Token" presale. If you see links to sites like xwalletplatform.io, do not click them.

🛑SCAM SITES DO NOT OPEN!🛑

coin-grok.com google-chain.com grok-exchange.com metawalletcoin.com sale-x.live trumpwlfgt.com wallet-grok.com x-coin-web.com x-platform.info x-presale.cc x-presale.info xaipresale.space xcoin-chain.io xcoin-crypto.com xcoin-crypto.io xcoin-crypto.org xcoin-finance.com xcoin-meta.io xcoin-tech.com xcoin-tech.io xcoin-wallet.io xcoin-web3.com xcoin-web3.io xcoinassets.io xcoincore.io xcoinexchange.io xcoinledger.com xcoinmarket.io xcoinplatform.io xcoinschange.com xcoinswap.io xcointrade.io xcryptocoin.io xcypto-wallet.com xeroxhedge.com xgrokwallet.com xgrokwallet.io xplatform-wallet.com xplatform-wallet.org xplatform.info xtokentrust.io xwallet-presale.info xwallet-presale.org xwalletplatform.io xwallet.global xwalletplatform.io xwalletschain.io xwalletweb.io

🛑SCAM SITES DO NOT OPEN!🛑

The Threat

The Scam: Malicious sites posing as official X/Twitter products.

The Risk: Clicking "Connect Wallet" triggers a drainer script that empties your crypto and NFTs instantly.

The Deception: They use "Gold" and "Blue" checkmarks to buy trust, but these are just hijacked or paid accounts.

Stay Safe

Verify the Domain: Official news only comes from x.com. Anything else is a trap.

Ignore Tags: If you are tagged in a "presale" post, it's a bot-driven attack.

Don't Connect: Never link your wallet to a site promising an "official" Musk/X coin. It doesn't exist.

Don't let a checkmark trick you—protect your keys.

Connecting here will drain your wallet

thanks Nikita Bier and Elmo Musk!

The “Elon Musk Casino” Scam: A Digital Mirage with a Refund Button

There is no such thing as an "Elon Musk casino" handing out free money. What exists is the usual scam nonsense: a fake promo, a shiny website, and a balance on a screen that only becomes “real” when you try to leave.

Here’s the trick. They tell you to enter a promo code, and suddenly you’ve “won” money. Congrats, you’ve won exactly nothing. It’s just numbers on a page, dressed up to look like a jackpot.

Then comes the punchline: when you try to withdraw, they demand a deposit to “verify you are not a bot” or unlock your funds. That deposit is not verification. It is the theft.

This is pig-butchering with a celebrity costume on it. Fake endorsement, fake winnings, fake rules, real losses. If a site needs you to pay money to collect money, it’s not a casino — it’s a scam with better lighting. TL;DR: You “win” fake money on the site, but to withdraw it you’re told to deposit real money first. Any money you send is lost.

SCAM SITES DO NOT VISIT!

The Fox is Guarding the Henhouse: Why sites.google.com is a Scammer’s Paradise

Let’s get one brutally honest fact out of the way: sites[.]google[.]com is an untrustworthy wasteland. Threat actors—ranging from DPRK’s Stardust Chollima to Russian teenagers running the Angelferno drainer—are using Google's free infrastructure to host phishing sites and steal millions in irreversible crypto transactions. Their primary distribution method?

GOOGLE ADS used to lead users to GOOGLE SITES via first result Paying Google Ads to blast their scams to the absolute top of your search results. Google is quite literally cashing ad-buy checks from criminals to intentionally poison its own search engine. Truly, good job, Google.

Try reporting this blatantly obvious fraud, and you'll quickly discover that Google's "Report Abuse" button is a total black hole. You get no tracking ticket, no human to escalate to, and zero operational visibility. Instead, you're stuck waiting out a pathetic one-week review SLA, which gives scammers all the time they need to drain victims dry. The irony here is staggering: Alphabet owns top-tier cybersecurity firms like Mandiant and VirusTotal, yet their internal synergy is so spectacularly non-existent that the threat intelligence arm seems entirely disconnected from the ad-revenue arm.

While third-party defenders are forced to scramble and slap warning banners on these domains at the zero-minute mark, Google remains an immovable, opaque bottleneck.

LIST OF SCAMS (DO NOT OPEN THEM!)

sites.google.com/view/s3-uniswap-dex-dapp-ad-105/ sites.google.com/view/s3-uniswap-dex-dapp-ad-186 sites.google.com/view/s3-uniswap-dex-dapp-ad-339 sites.google.com/view/sign-ins-web-kraken sites.google.com/view/s3-uniswap-dex-dapp-ad-221 sites.google.com/view/s3-uniswap-dex-dapp-ad-947 sites.google.com/view/s3-uniswap-dex-dapp-ad-815 sites.google.com/view/s1-unilabs-dapp-ad

The next time you see a sponsored Google Sites link, do yourself a favor: assume it’s a trap, roll your eyes, and keep scrolling.

Google sites - the GeoCities of 2026 which nobody needs Imagine if Alphabet, the company which owns Google Ads, Google Sites, Mandiant and ViruStotal could make the three heads talk to each other and actually use all the telemetry in the world, which they already have.

Endless reply spam fakes spread on Twitter/X

The real account tweets something, impersonator tweets below it - bla bla bla, enter here. Those links are fake.

For example FLARE FIOUNDATION pays twitter/x for a gold handle

This does not help at all with impersonators.

“the first 500 participants who cast their votes will earn a boosted” -

i wonder if nikita bier has tried this search

obviously very hard to detect for twitters amazing AI system, but me - random joe schmoe can see the patterns in the scams in 5 minutes as they stick out like sore thumbs

Clicking on the fake links results in WALLET DRAINER

A Complete Failure of Basic Moderation

Same scam different name

If you’ve seen a post from “MrBeast” claiming he’s launched a new cryptocurrency casino and is giving away thousands of dollars to anyone who registers—stop right there. It is a coordinated scam designed to drain your wallet.

The images look convincing. They use verified checkmarks and professional-looking web interfaces. But behind the curtain, it’s a classic “pig butchering” or “advance-fee” fraud.

How the Trap Works

The Bait: You see a “pinned post” or a profile link on X (formerly Twitter) or YouTube. It promises a massive reward (often $5,400 or more) just for signing up and using a promo code like MRBEAST.

The Hook: You register on a site like sugamb.at or beastcasino.net. Suddenly, your dashboard shows a massive balance. You think you’ve won!

The Twist: When you try to withdraw your “winnings,” the site tells you that you must first deposit real money to “verify your account” or “unlock” the withdrawal.

The Kill: Once you send your real crypto or cash, the scammers vanish. Your deposit is gone, and the “reward” balance—which was just a fake number on a screen—never existed.

The “Scam” Network

These sites are part of a massive, automated network. Scammers churn out dozens of these domains daily. Because they often share the same back-end infrastructure, your login credentials for one scam site will likely work on another. They are essentially digital clones designed to bypass platform bans.

The Blacklist

Avoid these domains (and any that look like them) at all costs. This is not an exhaustive list, but these are known malicious :

🛑 SCAMS: betiverse.me cestwin.com hoahux.com hustwin.com solantex.com

The Bottom Line

MrBeast is not giving away $5,000 via a random crypto casino. If a deal seems too good to be true, it’s because it’s a scam. These sites have nothing to do with Jimmy Donaldson or his brand. They are predatory “tumors” on the internet. Stay safe, keep your private keys private, and never deposit money to “unlock” a prize.

Breaking News: Billionaires Aren’t Giving Away Free Crypto on Random Websites

Let’s have a quick reality check, folks. Elon Musk is busy launching rockets, selling electric cars, and getting into internet beefs. What he is not doing is secretly partnering with poorly designed, hastily registered websites to double your Bitcoin.

I know, it's a shocking revelation.

If you somehow missed the massive red flags, just take a look at the screenshot floating around for sites like

welnom[.]com

These "giveaways" follow the oldest script in the book: register, send us a little bit of crypto to "verify" your wallet, and we'll send you back double! Spoiler alert: The only thing doubling is the scammer's bank account.

The "Do Not Click" Hall of Shame

To save you from yourselves, here is a massive list of domains currently operating this exact flavor of nonsense. If you see these links in your spam folder, Twitter replies, or YouTube comments, do not click them, do not register, and keep your wallet keys to yourself.

welnom.com sodexplay.com zaweu.com dobcas.com winnerslive.at tuatox.com eroxplay.com betingot.com retowex.com rodefex.com wuzodex.com gammer.live mizofex.com letofex.com bizofex.com operi.us fowatu.com guweu.com xhopex.com xerofex.com nemurex.com xefowex.com xopeu.com sugkas.com gambex.cc nensenplay.com xaspaze.com xhodes.com dowau.com aeternago.net jpweu.com xmagex.com eswao.com getodex.com subbex.live broxusbet.com casino-bit.me wemax.cc beastcasi.org pvcas.com drakecrow.com faweu.com soawin.com trumpgamb.com spacewin.cc zuemux.com vegamb.cc nemecaz.com puejax.com vaocox.com twogamb.at loavex.com beastfinals.com spinoo.win wintomax.cc spinrift.io spinlox.com mrwin.at gingamb.at sugamb.at celgam.com trugamb.cc tinobet.net nugamb.at rodgercasino.online beast-gamble.cc aml-analyze.com zegamb.at specialbonus.site goldencoins.cc gismoneya.click vyromex.com beast-reward.com kawild.com toti.live begamb.at casvax.com upgamb.at dezoxplay.com lunior.vip kuehax.com beastgames.lol mexawin.com relicbet.com bozewin.com venowin.com nesofex.com ceiwex.com wavcas.com jowatu.com bogamb.at atentix.live rexudex.bet happyjokers.cc nustwin.com aureogames.com omnex.vip ubgamb.cc spinhero.me zemeex.com thegrand.bet

Do not use twitter if you are into crypto

Here is why in pictures:

Here we see the original account tweeting something:

If You Are in Crypto, Do Not Use Twitter

If you are involved in crypto, it's time to abandon Twitter. The platform has completely devolved into a scammer playground and a cesspool, and frankly, it doesn't deserve a second of your time or energy.

If you want to know why, just look at the screenshots above.

The Anatomy of a Twitter Crypto Scam

The Bait: A legitimate brand account (like KAIO) tweets a real update.

The Hijack: Right below it, an impersonator account (using a slightly altered handle, like "KA1O") uses the legitimate tweet as a foothold to blast reply spam.

The Trap: That reply links directly to a wallet drainer.

The Twisted Business Model Take a close look at those images again. Both the legitimate project and the fraudster have verified badges.

This means Twitter is literally pocketing subscription revenue from both sides. They are taking money from the brand they are supposedly "protecting" from impersonation, while simultaneously cashing checks from the impersonators themselves to grant them fake credibility.

All of this happens while Twitter leadership boasts about how they are going to issue subpoenas to crack down on bots. Haha, right. I am sure Nikita Bier will personally be serving those subpoenas any day now.

A Complete Failure of Basic Moderation

Let’s be absolutely clear: TwitterX is a piece of garbage right now because it completely fails to combat basic, copy-paste reply spam. We aren't talking about sophisticated, highly advanced cyber attacks. We are talking about identical strings of text being blasted thousands of times—something a rudimentary spam filter from 2005 could automatically block.

You can test their miserable failure of a spam filter yourself.

Test it here: Click this link to search Twitter for the exact, copy-pasted spam text these wallet drainers use.