One Script, Four 'Academies': The WhatsApp 'Professor Benthorne' Scam, the AXIO Exchange and the Kit Behind 13 Live Fake Sites

BlockintAI · 2026-10-17T12:51:12.166Z

BlockintAI research. Site, DNS and registration checks were re-run on Saturday, October 17, 2026, between about 7:35 AM and 7:45 AM Central Time (CT), and first made on October 16 between about 10:00 PM and 10:50 PM CT. Times are CT unless marked UTC.

It started, like so many of these do, with a link for stock tips. In June 2026, one Reddit user later wrote, an "assistant" to a "Professor Benthorne" got in touch. For about six weeks the user sat in a WhatsApp group where the professor and his associates ran "training sessions" twice a day, handed out stock picks and spun a weekly prize wheel. Some prizes were real: the user says they won 0.02 ETH and tokenized NVDA stock and moved both to their own wallet. The assistant kept up a friendly private chat on the side.

Then, in early August, the group pivoted to crypto. The professor's AI futures system, the "Benthorne Execution System," was about to launch, and members were invited to a five-day "beta test." Each tester got $1,500 on the "AXIO trading platform" at www.oaxio[.]com to trade with.

On October 9, 2026, at 1:40 PM CT, that user posted the whole story as a comment in r/CryptoScams, under a thread asking whether anyone had heard of "Benthorne Scholastic of Finance." BlockintAI followed the domain. AXIO is still online this morning, and its homepage announces the Benthorne partnership in its own words. A second AXIO site carries it word for word, three sister sites run the same announcement with a different "academy" name each, and the software behind AXIO runs 13 live fake exchange sites in all.

Key facts

What the group sold

The Reddit account is detailed and, for this kind of scam, unusually patient. Here is how the user describes the weeks after the beta began.

• The trades. Each day the "assistants" posted one to three futures signals, usually about 30 minutes ahead, with direction, entry and exit times, usually 10–20% of the $1,000 manual allocation per trade, and leverage of 100x every time. Almost every beta trade made between 31% and 108%. The one loser (down 2%) was followed five minutes later by an 82% winner. By the user's count, 15 of 16 trades over two weeks were big winners.
• The rules. Of the $1,500, $500 was for "AI-automated" trading and $1,000 for manual trades on the assistants' signals. Losses would be "absorbed by BES." Profits belonged to the tester.
• The push. Throughout, the assistant urged the user to add their own money to increase their profits, as other members had done. Group members posted screenshots of trades up 200% and of gains in the hundreds of thousands of dollars. Bigger depositors were said to get extra signals.
• The token. Part of the user's profit came from the rise of BESAI, a token the group promoted.
• The second round. After the beta, the group announced a 10-day trading period. The user joined with their winnings, and every trade won again, by 36% to 92%.
• The "IEOs." From September the group kept up daily signals and promoted an "Initial Exchange Offering" for a token called OLP on October 4, 2026, which supposedly returned 7x to early subscribers. Next came ABP, scheduled for October 11, 2026. The user saw other members talk about cashing out 401(k) accounts and taking out loans to get in.

The user had tested the withdrawal function a couple of times, moving funds out and back in. When they finally tried to take out the full balance of about $1,300, AXIO's "security team" froze the account, saying they had made too many transfers in one day. The assistant got the funds released, the user withdrew, and they cut off contact. Others in that chat may not be so lucky. A freeze at withdrawal, followed by a fix from a friendly insider, tells the operators who is about to leave, and the same "security" and "compliance" language is what victims later hear when they are told to pay a fee to unlock their money.

What AXIO says about itself

The group's story is one person's account. The website backs it up.

The partnership is on AXIO's homepage. When we loaded web.oaxio[.]com at about 7:37 AM CT on October 17, the rotating announcement bar read: "[Product Launch] AXIO Partners with Benthorne Academy to Officially Launch Benthorne Execution System: AI Autonomous Trading Goes Live with Exclusive Limited-Time Deposit Rewards." The announcement list below it adds "Upcoming Launch: AXIO Partners with Benthorne Scholastic of Finance to Roll Out Benthorne Execution System and Debut Its Autonomous AI Trading Feature." The "exchange" and the "school" that steered people to it are announcing each other.

So are the token sales. The same feed carries "[World Premiere] AXIO to Launch OmniLink Protocol (OLP) Subscription and Spot Listing," "[Launchpad] OmniLink Protocol (OLP) Subscription Has Concluded," "OmniLink Protocol (OLP) Is Now Officially Listed on AXIO!" and "[World Premiere] AXIO to Launch AssetBridge Protocol (ABP) Public Sale." The ABP banner was also the one showing when we captured the homepage at about 10:30 PM CT on October 16.

The tokens trade only on these sites. AXIO's public market list includes BESAI/USDT and OLP/USDT. At 7:35 AM CT on October 17 the site showed BESAI at about 3.23 USDT and OLP at about 0.138 USDT. A CoinGecko search the same morning found no listing for BESAI, OmniLink or AssetBridge Protocol.

They were set up in advance. The token logos are served from upload folders named by date. BESAI's sits in a folder dated May 18, 2026, more than two months before the August "beta" where the group promoted it. OLP's is dated September 28, 2026, six days before its October 4 "IEO."

The rest of the feed reads like a real exchange's. It includes a "Deposit Address Update and Wallet System Upgrade" notice, tokenized-stock announcements, a 1,000,000 USDC "challenge" prize pool and a fake buyout announcement that uses the name of a real European broker. The app's code also includes a member endpoint named closeBeta and a pop-up "beta" dialog, the machinery for a trial like the one the group ran.

AXIO hands out deposit addresses only inside logged-in accounts, so the money trail starts at addresses only its users can see. If you put money in, your deposit address and transaction hashes are the most useful details you can give investigators.

Four "academies," one announcement

AXIO isn't alone. Four more sites load the same web-app JavaScript bundle, byte for byte, as AXIO (js/app.95227af5.js, SHA-256 0004be7003548bc3cf0d5d3a45ee23dcee84fcb9fa0b0b0400ce5379c6a2ea62), and a fifth runs a different build of the same kit. All four carry AXIO's announcement feed. On three of them, the brand and the "academy" change and the rest of the feed is nearly identical:

All four copies also announce the same OLP subscription and the same ABP public sale, and three brands list their own "AI" token next to OLP: BESAI on AXIO, OTSAI on AETCT and EOSAI on ZENA. Each "academy" appears to come with its own trading system, its own token and its own exchange name, so a group run by "Osterhaus Academy" can send members to an exchange that announces Osterhaus. We haven't yet seen a victim report naming Osterhaus, Harwardia or Everhayes. If one of those names reached you on WhatsApp, the script above is what comes next.

The registrations tie the group together too. All six are registered at Gname. Five were registered in two batches seconds apart, and all five use the same pair of Cloudflare nameservers:

• March 25, 2026, 8:54 AM CT: 5asdnj[.]one and 3nd82a[.]one (13:54:34 UTC) and 6qhicc[.]one one second later
• April 13, 2026, 11:09 AM CT: tubs03[.]top (16:09:30 UTC) and tuqs04[.]top three seconds later
• oaxio[.]com is older, registered July 30, 2025, and uses a different Cloudflare nameserver pair, but serves the identical app file, favicon and token list.

A seventh domain, wa01hju[.]one, registered at Gname on March 24, 2026, the day before the first batch, showed an exchange called "ORIGONIX" on the same kit in September. Its registration was put on clientHold (record last changed October 2, 2026), and it no longer resolves.

The kit, and the brands that share it

Every one of these sites runs the same software. It is a Vue web app with a "v-coin-home" loading screen, a BladeX back end (/api/blade-auth/oauth/token) and an exchange API under /api/mjkj-web/ and /api/mjkj-stock/ that answers in Chinese ("操作成功," "operation successful"). Each brand runs a web. desktop site and an m. mobile site, and the shared footer still contains an untranslated "订单详情" ("order details"). At 7:35 AM CT on October 17, every live host answered the kit's public clock endpoint, /api/mjkj-web/coin/open/currentTime.

Searching urlscan.io for the kit's API path and app files turned up three more brands on the same software. Each has its own app build, and none shares AXIO's tokens, announcements, nameservers or registration batches. No victim report names them yet, and nothing ties their operators to the AXIO group beyond the shared software.

"Sky" (C3 report below)

• web.skysx[.]info, Gname, registered March 30, 2026
• web.adfn02u[.]top, Gname, registered December 2, 2025 (same app file as skysx)
• web.wgkkx[.]one, branded "WK," Gname, registered September 8, 2026, on an Alibaba Cloud CDN address rather than Cloudflare. It serves the same 109-pair market list as Sky.
• The back end reports its market setting as "泰国市场" ("Thai market"). The homepage says the platform "holds multiple international financial business licenses" and serves "over 150 countries and regions," and its announcement bar promotes the coming launch of something called "CryptraPay."

"COINP" (C3 report below)

• web.roc-coinp[.]com, Realtime Register, registered August 14, 2026 (1:11 AM CT)
• web.sacoinp[.]com and web.twncoinp[.]com, Cosmotown, registered September 22, 2026, two seconds apart (4:03 AM CT)
• All three serve one identical build, on both web. and m. hosts.

"Jupiter Perps SA" (C3 report below)

• web.jupiterperpssa[.]com, GoDaddy, registered September 10, 2026 (7:02 AM CT), trading under a lookalike name copied from a real crypto perpetual-futures product. Its back end runs on South African time (Africa/Johannesburg); the others run on New York time.
• Its twin, jupiterpsa[.]com, was registered at GoDaddy five seconds earlier and showed the same "Jupiter Perps SA" title in an October 9 urlscan scan. It returned a Cloudflare 520 error on October 16 and no longer resolved on the morning of October 17.

Two more kit domains, sxsvi[.]vip ("SXSVI") and rdrmf[.]com, both at Gname, were scanned on the kit in September 2026. Both are now on clientHold, with records last changed September 30 and September 24, and neither resolves.

The Cloudflare nameserver pairs repeat across these brands. One pair serves skysx[.]info, roc-coinp[.]com and jupiterperpssa[.]com, and another serves sacoinp[.]com and twncoinp[.]com. That can mean a shared Cloudflare account. It isn't enough to say who runs them.

Status of every domain (October 17, 2026, about 7:35 AM CT)

Registrar abuse contacts from the same RDAP records: Gname complaint@gname.com, Realtime Register rtr-security-threats@realtimeregister.com, Cosmotown abuse@cosmotown.com and GoDaddy abuse@godaddy.com.

Red flags in this script

• A stock-tips "professor" on WhatsApp who moves the group to crypto. The "academy" is the funnel and the exchange is the trap. Every name in it, from the professor to the trading system and the token, can be swapped out.
• Free trial money. A $1,500 "beta balance" costs the scammers nothing. It exists to make the platform look real and to get you to add your own money.
• Trades that always win. Fifteen winning 100x futures trades out of sixteen isn't skill. It's a number typed into a database.
• Tokens you can only buy in one place. If a token like BESAI, OLP or ABP trades only on the platform promoting it, the platform sets the price.
• "IEOs" announced to a chat group. A 7x "return" posted in a group full of cheerleaders is advertising.
• A frozen account when you try to leave. "Security team," "too many transfers," "AML review" and "verification" are reasons to stop, not to pay. Anyone who then offers to recover your money for a fee is running the next scam.
• Report it. In the U.S., report fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Elsewhere, report to your national police cybercrime unit. You can also file a report at blockint.ai with the domains, chat names, deposit addresses and transaction hashes; it is free, and anonymous reports are accepted.

Related BlockintAI reports

• AXIO (oaxio[.]com) and the six linked domains in the Benthorne group
• "Sky" fake exchange: skysx[.]info, adfn02u[.]top, wgkkx[.]one
• "COINP" fake exchange: roc-coinp[.]com, sacoinp[.]com, twncoinp[.]com
• "Jupiter Perps SA" fake exchange: jupiterperpssa[.]com, jupiterpsa[.]com

Sources

Victim account

• Reddit r/CryptoScams, comment pewhiqr, posted Oct 9, 2026, 1:40 PM CT, in the thread "Has anyone heard of Benthorne Scholastic of Finance": https://www.reddit.com/r/CryptoScams/comments/1x02yhd/has_anyone_heard_of_benthorne_scholastic_of/pewhiqr/. The same text was posted a minute earlier in r/CryptoCurrencyClassic (comment pewha1g). Archived copy: https://api.pullpush.io/reddit/search/comment/?ids=pewhiqr

The sites (public pages and public API, no login; checked Oct 17, 2026, 7:35–7:45 AM CT)

• AXIO homepage and announcement feed: web.oaxio[.]com. The same feed on web.6qhicc[.]one, web.tubs03[.]top, web.tuqs04[.]top and web.5asdnj[.]one
• Public market lists (BESAI/USDT, OLP/USDT and token logo paths): /api/mjkj-web/coin/open/getSpotGoods on each host
• Kit clock endpoint: /api/mjkj-web/coin/open/currentTime on each host
• Kit search: urlscan.io public search for filename:"mjkj-web" and the app-file names: https://urlscan.io/
• Token listings: CoinGecko search (BESAI, OmniLink, AssetBridge; Oct 17, 2026): https://www.coingecko.com/

Registration and DNS

• RDAP for .com domains (Verisign): RDAP record for oaxio[.]com; the same path works for each .com domain above
• RDAP for .one, .top, .info and .vip (rdap.org bootstrap): RDAP record for 6qhicc[.]one; the same path works for each domain above
• DNS over HTTPS (Google Public DNS): A record lookup for web.oaxio[.]com