blockintAI · Research blog

The $200 'AML Verification' Fee: DEXGETO and the Fake-Exchange Kit Behind Two Dozen Domains

BlockintAI · 2026-10-20T21:21:00.000Z

BlockintAI research. The DEXGETO site, its AML Policy and its User Agreement were captured on Monday, October 19, 2026, between 7:13 and 7:18 AM Central Time (CT). Registration (RDAP), DNS and kit-file checks on all 23 domains were run at 7:13–7:14 AM CT and again at 7:02 PM CT. The deposit addresses were re-checked on-chain at 7:16 AM and 7:08 PM CT. Times are CT unless marked UTC; registration dates are UTC.

At 12:16 PM CT on Sunday, October 18, 2026, a Reddit user posted a short warning in r/CryptoScams titled "Warning about DEXGETO crypto arbitrage." Eleven seconds later the same post appeared in a second scam-warning forum.

"Be careful with DEXGETO (dexgeto[.]com)," it began. "The platform is promoted through videos showing price differences between Binance and DEXGETO, making arbitrage profits look easy. The red flag comes when users try to withdraw their funds and are told to deposit an additional $200 for AML verification before withdrawals are allowed."

The poster finished with the advice that matters most: "never send more crypto just to release a withdrawal."

That one post is the only public account of DEXGETO that BlockintAI has found. The site itself says a good deal more. Its legal pages contain a 200 USDT charge of their own, though nothing public confirms it is the fee in the warning. And its code is not its own. It runs on a fake-exchange kit that BlockintAI found behind at least 23 domains, several of them registered in the last four weeks and eight already pulled by their registrars.

Key facts
The warning Reddit r/CryptoScams, Oct 18, 2026, 12:16 PM CT, crossposted 11 seconds later. Says DEXGETO is promoted with videos showing "arbitrage" price gaps against Binance, and that withdrawals are blocked until the user deposits "an additional $200 for AML verification." One user's account; the poster doesn't state a personal loss
The site dexgeto[.]com, "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | DEXGETO." Registered through Eranet International Limited on Sept 24, 2026 (01:20 UTC); its site icon's file name carries a timestamp 24 minutes later. Behind Cloudflare
A 200 USDT fee in its own terms The User Agreement (captured Oct 19) says that to "participate in cryptocurrency arbitrage on the platform, the User must activate VIP status," and that "the cost of activating VIP status is 200 USDT, payable in a single lump-sum payment." Whether this is the "AML verification" fee in the warning is unconfirmed
Who it says runs it "DEXGETO Technologies Limited (Panama)." Eight sibling sites name "<Brand> Technologies Limited (Panama)" in the same place
The kit At least 23 domains. Ten serve byte-identical kit files (main.js, calm-ui.css and the support-chat script); two run a variant build; the rest were matched on the kit's page template and file layout
Newest siblings rupdex[.]com ("RUDEX") and wuldex[.]com ("WULDEX"), both registered through NiceNIC on Oct 13, 2026, 32 seconds apart. RUDEX's User Agreement carries the same 200 USDT "VIP status" clause
Takedowns Eight kit domains are on registrar hold: six with registration records last changed between Sept 22 and Oct 7, 2026, and two more placed on hold on the morning of Oct 19 (6:30 and 6:52 AM CT). A Bybit lookalike sits behind Cloudflare's "Suspected Phishing" warning
Deposit addresses The site's deposit page displayed one address each for USDT (TRC-20 and ERC-20), ETH, USDC and BTC on Oct 18. None had received anything as of 7:08 PM CT on Oct 19, and none is on OFAC's sanctions list
BlockintAI reports DEXGETO, DetixBit and Charix, filed Oct 18, 2026

The pitch: free money from a price gap

Arbitrage is a real trading strategy. If bitcoin trades a little cheaper on one exchange than on another, a trader can buy on the cheap one and sell on the dear one. In practice the gaps between large exchanges are tiny and close within seconds, and the firms that profit from them run automated systems with large balances.

The DEXGETO pitch, as the Reddit post describes it, turns that into a screen recording: a video showing a price on DEXGETO that differs from the price on Binance, and the implied promise that anyone can pocket the difference. It's a pitch that needs the target to send money to DEXGETO first, because the "cheap" side of the trade only exists there.

That is the core of every fake exchange. The price on the screen, the balance in the account and the profit on each "trade" are numbers in a database that the operator controls. The only real transaction is the deposit.

The fee, written into the terms

Real exchanges run anti-money-laundering (AML) checks, and they can hold a withdrawal while they do. What they don't do is ask you to send more money to have your own money released.

DEXGETO's own AML Policy, captured on the morning of October 19, doesn't mention any fee. It is several pages of standard compliance text. It describes a "Compliance Officer," KYC checks "before entering business relations," and transaction reviews that take "up to 24 hours." Nothing in it asks a customer to deposit anything.

A 200 USDT fee does appear, in a different document. DEXGETO's User Agreement has a section headed "VIP Status":

"To participate in cryptocurrency arbitrage on the platform, the User must activate VIP status. The cost of activating VIP status is 200 USDT, payable in a single lump-sum payment. The 200 USDT activation fee is not charged or withheld as a commission. Once credited, the entire amount remains in the User's account balance and is available for withdrawal along with the User's other funds in accordance with the applicable withdrawal procedures."

The Reddit post describes a $200 "AML verification" deposit demanded at withdrawal. The site's terms describe a 200 USDT "VIP status" fee to trade arbitrage. The amounts match, but nothing public shows they are the same charge. Either way, the terms promise that the 200 USDT "remains in the User's account balance," and on a site where the balance is whatever the operator says it is, that promise costs the operator nothing.

If a "support" agent points to a clause like this to justify a fee, a fee written into the terms doesn't make the money any more reachable.

The same agreement holds two more details worth knowing:

  • It bars Americans. Among the people who may not use the platform, it lists anyone who "is a citizen and/or resident of the United States of America." A clause like that could give the site a ready excuse to freeze an account.
  • It was assembled from parts. In the middle of the English text sits a paragraph in Russian. It says DEXGETO may require users to confirm their identity, including their phone number, identity documents or home address, and "reserves the right to request additional real-time video verification." The same untranslated paragraph appears on eight sibling sites.

One kit, many storefronts

Look past the logo and DEXGETO is a template. Its homepage loads three files that BlockintAI compared byte for byte across every domain it could find:

  • assets/js/main.js?v=7, SHA-256 beginning 43a968ec11a0d14e
  • assets/css2/calm-ui.css?v=15, SHA-256 beginning a7c65e435d2a529c
  • assets/js/support.js?v=2, the support-chat script, SHA-256 beginning f33e92760ef83535

On October 19, the same three files, identical to the byte, were served by nine other live sites: detixbit[.]com, bitrax[.]io, bitnax[.]io, coinsco[.]io, nexoex[.]io, cryptolane[.]org, safelychange[.]global, rupdex[.]com and wuldex[.]com. All of them use the same page-title pattern, "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | <Brand>," and call the same back-end paths, including /api/links/track and /api/exchange/market/klines.

Two more, charix[.]org and arunacoin[.]com, run a variant build. Their main script shares 383 of its 389 lines with DEXGETO's, their support-chat script shares 570 of 572 lines, including the same /api/user/support/get and /api/user/support/send endpoints. Charix's coin icons are byte-identical to DEXGETO's.

Identical files on separate domains mean a shared kit. They don't by themselves name one operator; kits like this are sometimes sold or rented. But there is a second clue that points to one control panel.

Tenant numbers in the file names

Each kit site stores its icon under a path like domain_icons/10_1790214288336.png. The first number looks like a tenant number in a shared admin panel. The second is a timestamp in milliseconds.

DEXGETO's icon is tenant 10, uploaded at 01:44 UTC on September 24, 2026. The domain itself was registered at 01:20 UTC the same night. If that timestamp marks the upload, the storefront's icon went up 24 minutes after the name was bought.

The other icons BlockintAI found carry tenant numbers 1 (detixbit[.]com, uploaded Sept 9, 2026), 16 (charix[.]org, Sept 21), 27 (coinsco[.]io, July 6), 31 (nexoex[.]io, July 23) and 52 (arunacoin[.]com, Oct 15). If those numbers count brands in one panel, the panel holds at least 52, far more than the domains found so far.

The VIP clause travels too

The User Agreements on the sibling sites follow one template. Each names "<Brand> Technologies Limited (Panama)" as the company: DetixBit, Bitrax, Bitnax, Coinsco, Nexoex, Cryptolane, WULDEX and RUDEX Technologies Limited, all "(Panama)." Each carries the same Russian paragraph.

Only two of them, as captured on October 19, carry the 200 USDT "VIP status" clause: DEXGETO's and RUDEX's. RUDEX lives at rupdex[.]com, registered on October 13, 2026 at 00:55:57 UTC. Its twin wuldex[.]com was registered 32 seconds later, at 00:56:29 UTC, through the same registrar, NiceNIC. That may mean the clause is an option switched on for some brands. RUDEX is one of the two newest.

Pulled, replaced, pulled again

The kit's domains don't last long, and registrars have been taking them down.

Domain Registrar Registered (UTC) Status, Oct 19, 2026
bitlua[.]com NameSilo July 6, 2026 On hold (record changed Sept 22)
novaexbit[.]com NiceNIC July 3, 2026 On hold (Sept 22)
yuklaswap[.]com NiceNIC Feb 21, 2026 On hold (Sept 24)
arbitriumbit[.]com Dominet Sept 13, 2026 On hold (Sept 30)
diabasecoin[.]com NiceNIC Sept 23, 2025 On hold (Oct 5)
changehero[.]global PDR Oct 2, 2026 On hold (Oct 7), five days after registration
vutereck[.]com Atak Apr 18, 2026 On hold (Oct 19, 6:30 AM CT)
ipoxinvest[.]com Realtime Register Aug 13, 2026 On hold (Oct 19, 6:52 AM CT)
bybit[.]casa GoDaddy June 28, 2026 Behind Cloudflare's "Suspected Phishing" warning
dexgeto[.]com Eranet Sept 24, 2026 Live, no hold
rupdex[.]com, wuldex[.]com NiceNIC Oct 13, 2026 Live, no hold

changehero[.]global borrows the name of a real crypto swap service, and bybit[.]casa the name of a major exchange. Most of the others are invented names built to sound like an exchange: "-bit," "-ex," "-coin," "-swap."

NiceNIC is the most common registrar in the set, with 12 of the 23 domains. The pattern is the same one seen with other fake-exchange kits: each takedown costs the operator one name, and the next name is usually already registered. DEXGETO was registered two weeks before changehero[.]global was pulled, and RUDEX and WULDEX were registered six days after it.

At 7:52 PM CT on October 19, dexgeto[.]com still resolved, still had no hold on its registration, and still served the DEXGETO exchange page.

What's on-chain, and what isn't

On October 18, DEXGETO's deposit page displayed five addresses:

None of them has ever received a transaction. At 7:08 PM CT on October 19, Etherscan showed zero transactions, zero token transfers and a zero balance on the three Ethereum addresses, TronGrid showed the TRON address was never activated, and mempool.space showed no history for the bitcoin address. None of the five is on OFAC's Specially Designated Nationals list, and none carries an Etherscan name tag.

That isn't a sign the site is harmless. Kits like this typically generate fresh deposit addresses, so an empty address only means no payment has reached that particular one yet. The DetixBit and Charix deposit pages showed their own sets of addresses, also unused and not shared with DEXGETO. They are listed in BlockintAI's DetixBit and Charix reports. So far there is no on-chain link between the brands; the link is the code.

If you sent crypto to any DEXGETO address, your own wallet or exchange history is the record that matters. Keep the transaction IDs, the deposit address you were shown and every message from "support."

Red flags

  • A fee to withdraw. Any demand for a new deposit to unlock a withdrawal, whether it's called AML verification, VIP status, a tax, a "margin" or an unlocking fee, is the scam itself. The SEC and the CFTC both warn that fake platforms invent "fees or taxes" when a target tries to withdraw.
  • Arbitrage that only works on one site. If the "cheap" price exists only on the platform someone is steering you toward, the price is invented.
  • Terms that explain the trap in advance. A clause that tells you the fee "remains in the User's account balance" is not protection. It's a script.
  • A young domain. dexgeto[.]com was less than four weeks old when the warning appeared. Look up the registration date of any exchange you're sent to.
  • A company name from a template. "DEXGETO Technologies Limited (Panama)" appears on DEXGETO's site; the same formula, with the brand swapped, appears on eight others.
  • A video or a contact doing the selling. Real exchanges don't recruit customers through demo videos of easy profits or through a new online friend. If someone sent you the link, ask how they make money from you joining.

If you've sent money

  • Stop paying. No further deposit will release the balance. Don't pay a "VIP," "AML" or "verification" fee, and be wary of anyone who later offers to recover the money for a fee. That is a second scam.
  • Keep everything: transaction IDs, the deposit addresses, screenshots of the balance and the fee demand, and the chat with "support."
  • Tell your exchange or wallet provider if you bought the crypto there. They may be able to flag the destination.
  • Report it. In the U.S., report to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Also file a report at blockint.ai with the site name, the deposit addresses and the amounts. It's free, and anonymous reports are accepted.

BlockintAI has covered other fake-exchange kits that work the same way, including AXIO and Benthorne, Svgweb and Rockie and the domain-hopping FXO broker.

#CryptoScam #PigButchering #FakeExchange #ScamAlert

Sources

The public warning

The site and its terms (captured Oct 19, 2026, 7:13–7:18 AM CT; do not visit)

  • dexgeto[.]com homepage, /aml-policy and /user-agreement
  • rupdex[.]com /user-agreement (VIP status clause), and the /user-agreement pages of detixbit[.]com, bitrax[.]io, bitnax[.]io, coinsco[.]io, nexoex[.]io, cryptolane[.]org and wuldex[.]com, captured Oct 19, 2026, 7:02 PM CT

Registration and DNS

On-chain checks (Oct 19, 2026, 7:08 PM CT)

Guidance