Two Fake-Exchange Kits Mapped: 81 'calm-ui' Domains, a Shared TON Deposit Counter, 49 Sites on 2024 Code, and AVAL/NMGEE Next to 3 FBI-Seized Domains

BlockintAI · 2026-10-26T22:32:59.617Z

Fake crypto exchanges are rarely one-off websites. Most are brands stamped out of a software kit: the same code, the same admin panel and often the same deposit back end, under a new name and domain every few weeks. When one domain is taken down, the next one is already live.

This post maps two of those kits from public evidence and from the deposit pages of five live sites, read on October 25, 2026. It lists every brand, domain, backend host and wallet we can tie to each kit, with the evidence behind each link.

• The 'calm-ui' kit, which we also call the doostoken kit after one of its domains: 81 domains, 74 of them in three identified builds. Three of its brands, coinsco, hederabit and soinaxbit, give out deposit memos from one TON wallet on one shared counter. cryptovos's XLM deposit wallet was listed by PCrisk for two other fake platforms in 2024 and received 4.6 million XLM between September 2025 and October 2026. One of those 2024 platforms, venanco[.]com, ran code that shares the kit's sign-up endpoint and page layout, and as of Oct 25, 49 sites with live sign-up pages served its 2024 code.
• The AVAL/NMGEE kit: nine brands; the recent ones call backend API hosts on four domains. Three domains tied to the kit, avalcoin[.]com, ftzcoin[.]com and ofdd[.]com, showed FBI seizure notices on Oct 25, while the backends behind the live brands answered requests that day.

Times are US Central Time (CT).

Key facts

Part 1: The 'calm-ui' (doostoken) kit

How the kit is recognised

Most sites in this kit are multi-language "exchanges" with a page title in the form "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | <brand>", staking and "earn" pages, a support chat, and a deposit page inside the account area. Invite and referral codes are optional at sign-up. The site's API calls go to its own domain, and each brand's logo is stored as domain_icons/<tenant number>_<upload time>.png, which points to one multi-tenant admin panel.

The builds are identified by byte-identical JavaScript files (SHA-256 hashes):

• Build A: assets/js/main.js?v=7 43a968ec11a0d14e74803aeb91efe593ffbf9e6e6432a2e099caee2108fca7db, support.js?v=2 f33e9276…, calm-ui.css?v=15 a7c65e43…
• Build B: assets/js/main.js?v=3 312c94806fe277640fdcef8040ce6ed8e428064dd92c8866f3bafb84b797b40d, support.js?v=2 30a99545…, root.css?v=th6 e0ac82b0…
• Build C: variant main.js v5/v6 files with shared toastr.js (5a8f36a0…) and noti.js files and a "landings" page layout

A file match shows the same software, not the same operator. Different groups can rent or copy the same kit.

Every domain on the kit

Status is from a live check on Oct 25, 2026, 5:45 to 5:47 PM CT (DNS, home page and main.js hash).

Build A (main.js?v=7 or a near-identical variant):

bitrue[.]io and changehero[.]global use names that also belong to unrelated real services (the Bitrue exchange at bitrue[.]com and the ChangeHero swap service). We have no indication either real service is involved.

Build B (main.js?v=3):

The names MindChain Swap and NarwhalSwap were used by earlier, unrelated crypto projects; we have no indication those projects are involved.

Build C (variant main.js, shared toastr.js/noti.js):

We have no indication that the Bybit exchange is involved with bybit[.]casa. The build-C files are also served straight from the IP address 138[.]226[.]237[.]36 under the brand XNTWALL (public urlscan.io scan, Sep 28, 2026), with no domain name attached.

Seen only in earlier public scans (urlscan.io, Sep 18 to Oct 18, 2026). All are now offline:

• With kit files or the kit's icon and page layout: arbitriumbit[.]com, bitlua[.]com, novaexbit[.]com, rucabit[.]com
• With the kit's page-title template only (lower confidence): yuklaswap[.]com, bynex[.]net, vutereck[.]com

35 more sites on builds A, B and C, live as of Oct 25

On Oct 25 between 6:00 and 6:10 PM CT, 35 more sites loaded kit JavaScript files whose SHA-256 hashes are byte-identical to the kit files on already-reported sites, and each had a live sign-up page (HTTP 200) containing the kit's account-registration call; all 35 sign-up pages were live again at 6:28 to 6:33 PM CT. None of them was in our earlier kit reports. All 35 were posted publicly as new scam exchanges in the Reddit community r/Crypto_Scam_Exchange between June and October 2026. Our report lists 33 of them, which is why its title says 33. The other two, cobinhood[.]io and kaoyaswap[.]com, were already in earlier blocklist reports (cobinhood[.]io, kaoyaswap[.]com), so they are linked there rather than listed again. With the 46 domains above, that makes 81.

• Build A (13 sites), main.js?v=7 and support.js?v=2, the same files served by cryptovos[.]com and coinsco[.]io: bcmex[.]io, binarmy[.]com, binoter[.]io, biqanex[.]com, bitlabe[.]com, bitlango[.]com, cobinhood[.]io, egtrix[.]com, nexoro-ltd[.]com, novabitex[.]com, poreebit[.]com, ragefull[.]com, xpay[.]global
• Build B (2 sites), main.js?v=3 and support.js?v=2, the same files served by labswap[.]io: kaoyaswap[.]com and vesq[.]io. Both also use the brand name "Alter" and the same admin logo file as labswap[.]io (uploaded Jul 20, 2026, 12:45 PM CT).
• Build C (20 sites), main.js?v=5 or v=6 in one of three kit versions, most with one of the kit's noti.js files:
  • the bitgaz[.]com version (f8726009…): alfobit[.]com, bitnool[.]com, itrustcap[.]com, manav-gubta[.]com, xpressobit[.]com
  • the yoplabit[.]com version (ea0d7e71…): avex[.]cash, bit-liqud[.]com, bit-mod[.]com, bit-save[.]com, bityra[.]com, bytuno[.]com, globalxinvest[.]com, kiwiswap[.]io, metldex[.]com
  • the wexkey[.]com version (cf7a7620…): microndex[.]com, zamdex[.]com, zewdex[.]com, zimdex[.]com
  • noti.js match only (da7bfece…, the same file as on wexkey[.]com), with a main.js not seen elsewhere (medium confidence): trustchainu[.]com, zetbix[.]com

Some of these names resemble real or former companies (Cobinhood, iTrustCapital, Global X); we have no indication they are involved.

One logo-upload session. The kit stores each brand's panel logo under a file name containing its upload time. Six build A brands had their panel logos uploaded on Oct 25 between 4:04 and 4:13 AM CT: cobinhood[.]io (4:04), binoter[.]io (4:05) and coinsco[.]io (4:13) each have their own logo file, and bcmex[.]io, biqanex[.]com and novabitex[.]com all serve the same admin logo file, uploaded at 4:13. coinsco[.]io showed a different logo file in a public urlscan scan on Oct 24. These times show when the logos were uploaded, not when the sites were set up.

What the deposit pages showed

Accounts opened on five live kit sites on Oct 25 (cryptovos, coinsco, labswap, hederabit and soinaxbit) each received a full set of deposit addresses, 18 to 28 per site. Build-A sites list a per-account address for most coins plus a few memo wallets, where every user pays the same address and is told apart only by a memo or tag. labswap[.]io (build B, brand "Alter") lists only per-account addresses and no memo wallets.

Of the 123 deposit addresses the five sites showed (counting the shared TON wallet once per site), 118 had never been used on-chain on Oct 25. The five used entries are the memo wallets below.

One TON wallet, one counter, three brands

coinsco[.]io, hederabit[.]com and soinaxbit[.]com all show the same TON deposit address:

UQC4pGjqlXmc9dKm4rTSfcWBbNthq_lEiOjn-bQn1fnNRRFa (tonviewer)

The memos the three sites issued on Oct 25, within about 16 minutes, run in one unbroken sequence:

On-chain, the wallet's 98 incoming deposits with numbered comments in this series (76 distinct memo numbers) form one rising sequence over 14 months, from 10000000001 on Aug 20, 2025 to 10000002258 on Oct 17, 2026, with only four small deposits out of order (count from the public tonapi.io event history, Oct 25, 5:59 PM CT). Four USD₮ deposits in September 2025 used a separate 2000000xxxx series. That is one counter, not one per brand: these three brands do not just share software, their TON deposits are numbered by one shared counter on one wallet.

What the wallet received and where it went:

• Active since Aug 15, 2025. Incoming transfers total 5,115.90 TON and 5,604.81 USD₮ (tonapi, Oct 25, 2026). Several were customer withdrawals from large exchanges (names from the TON explorer); this does not implicate the exchanges.
• Forwarded within minutes. Each deposit moved on to one of a set of rotating unlabeled wallets (0:e40829…0873, 0:e06032…45ec, 0:9fd48b…2849, 0:fd2636…1a25, 0:a233c3…d9b0 and others). Two of them sent funds on to the swap service FixedFloat (TON explorer name), and four of them pay the same two downstream wallets.
• Quiet now. The last deposit of $10 or more arrived on Oct 3, 2026. On Oct 25 the wallet held 6.42 TON and 29.94 USD₮.

cryptovos: an XLM wallet with a 2024 history

cryptovos[.]com shows two memo wallets.

XLM: GBKVX2PYUFUIBI45VDJKBRMNSR4UIKLBFKF3JAP2DQAY26YHRU4BSINA (stellar.expert)

• Created Oct 31, 2023. Its deposits carry memos in one sequence (1000012xxxx); the memo cryptovos issued on Oct 25, 10000124149, follows the last one paid, 10000124147, on Oct 23.
• 4,607,678.57 XLM in from 50 sending addresses between September 2025 and October 2026 (the period the public Stellar API keeps). Most of it, 4,366,942.39 XLM in 329 payments, came from one unlabeled account, GBYWFM64…32BE.
• 4,582,816.11 XLM out, mostly to exchanges. The largest share, 2,888,514.49 XLM in 1,154 payments, went to a memo-required deposit wallet labelled Bybit on stellar.expert (GDT7ARDY…MTIH). Smaller amounts went to wallets labelled MEXC, Binance Deposits and GateIO. Payments to Bybit ran every month from September 2025 to August 2026.
• Balance on Oct 25: 78,978.67 XLM.
• Earlier brands. PCrisk, a community security site, listed this exact address among the "Cyber Criminal Cryptowallet Addresses" on two fake crypto platform pages published on March 20, 2024: weyshare[.]com and venanco[.]com. The same deposit address has therefore been shown for at least three fake-platform brands, in 2024 and in 2026. As of Oct 25, 49 sites with live sign-up pages served venanco[.]com's 2024 JavaScript (see below).

XRP: rBXUYa3pb8xEZTfwXGUxFJzkgPC4uSTcEU (XRPSCAN)

• Created Oct 15, 2026, by an exchange withdrawal credited to destination tag 1000255225. The wallet switched on "destination tag required" the same afternoon.
• 78,837.727126 XRP has come in from 32 sending addresses (transfers of about $10 or more) and none has left. Destination tags run in one sequence, 1000255225 to 1000256669; the tag cryptovos issued on Oct 25 was 1000256766.
• Many senders are customer withdrawals from more than a dozen exchanges (XRPSCAN names); this does not implicate the exchanges.

The other 16 cryptovos addresses, and every non-TON address on coinsco, hederabit and soinaxbit, had no on-chain history on Oct 25.

venanco[.]com's 2024 code on 49 sites

venanco[.]com points to what appears to be an older generation of the kit. An archived copy of its sign-up page (Wayback Machine, Jun 6, 2024) loads app.min.js (SHA-256 beginning 84c100eb29667fad) and sing-in.min.js (beginning 648f318c417aef7e), and uses the same /api/auth/register endpoint (captcha and promo-code fields), /profile/wallet redirect and logo naming as the 2026 kit. (report)

On Oct 25, 49 sites had a live sign-up page (HTTP 200) and served this generation's files (checked between 6:00 and 6:10 PM CT, and again between 6:28 and 6:33 PM CT):

• Posted on r/Crypto_Scam_Exchange (34 sites, June to October 2026). Each served app.min.js byte-identical to venanco[.]com's 2024 file, and all but btcitrader[.]com also served the identical sing-in.min.js: 0xplatform[.]com, abrazostores[.]com, additivejeweltechkz[.]com, avrisinc[.]com, azuregnv[.]com, bepfi[.]com, bitcitechnology[.]com, bitgoodies[.]com, bitpuller[.]com, blackventure[.]org, blackventure[.]us, btcitrader[.]com, diestamparchivehq[.]com, digitellics[.]com, eizonhomes[.]com, equineerapp[.]com, execsigners[.]com, falconquad[.]com, gnosiallc[.]com, hormuztransit[.]org, jkylcsx[.]com, klicvenue[.]com, ledgex[.]us, lithostandardskz[.]com, metalepochkaz[.]com, mginnovant[.]com, nfinitapp[.]com, oxixx[.]biz, pealysoft[.]com, phaemladen[.]com, primetrux[.]com, staxcaps[.]com, suvasatech[.]com, whitecapital[.]top
• Found through public urlscan scans that recorded the same app.min.js hash (14 sites), plus coingate21[.]pro, which serves the same page as coingate21[.]com: weareoxis[.]com, globaxio[.]com, capabit[.]com, safetus[.]com, one-trade[.]cc, arqamtube[.]com, ayasacorp[.]com (home page behind a Cloudflare phishing warning; sign-up page live), breezex[.]hk, valerantis[.]hk, quantivion[.]hk, fantasybit[.]net, coingate21[.]com, coingate21[.]pro, verbiter[.]com, bingexer[.]biz
• Eight of those served a different app.min.js on Oct 25: breezex[.]hk, valerantis[.]hk, quantivion[.]hk, fantasybit[.]net, coingate21[.]com and coingate21[.]pro (beginning 87dbae4c0439ab8b), and verbiter[.]com and bingexer[.]biz (beginning ee8de599ff4b79bb). All eight served the identical sing-in.min.js and the same newnoti.js (beginning dd48e784f6f81b33) as the other sites.

Many of these sites carry the title "<Brand> — Secure Cryptocurrency Trading Platform" and use panel logo numbers that rise with their upload dates, from 246 (execsigners[.]com, March 2026) to 286 (weareoxis[.]com, October 2026), consistent with one panel installation adding brands over that period.

How strong the links are: high confidence that 41 of the sites run the same kit generation as venanco[.]com's 2024 site (byte-identical app.min.js), and medium for the eight that now share only sing-in.min.js and newnoti.js. Medium confidence that this older generation and the 2026 cryptovos[.]com build belong to one kit lineage, based on the shared registration endpoint and page layout and on the XLM wallet listed for venanco[.]com in 2024 and shown by cryptovos[.]com in 2026. This is a software kit match, not a shared operator finding. The coingate21 names resemble CoinGate; we have no indication it is involved.

What users have reported

A Reddit user posted in r/CryptoScams on Oct 18, 2026 that DEXGETO, a build-A site, is promoted with videos of "arbitrage" price gaps, and that users trying to withdraw are first told to deposit another $200 for "AML verification". This is one unverified report. Earlier BlockintAI reports on this kit list the deposit addresses that dexgeto[.]com, detixbit[.]com and charix[.]org showed on Oct 18.

Part 2: The AVAL/NMGEE kit

How the kit is recognised

Every brand in this cluster uses the page title "<BRAND> - One-Step Platform for Buy/Sell/Trade All Cryptos", runs its web app on a pc. subdomain, and requires an invite code to sign up. The app talks to a separate backend API domain through dozens of identical API paths (for example /api/recharge/url, /api/market/info/recharge, /api/second/contract/open, /api/ieo/exchange), the same "Please login firstly" reply and byte-identical stock coin icons. The apps offer fixed-time "seconds" or "Options" trades, token-sale ("IEO") boards and staking.

NMGEE's app is a separate build, not a copy of AVAL's files, but the two share 41 identical backend API paths; each archived FTZCOIN app bundle shares at least 42 with the AVAL app.

Brands, domains and backends

Several brands share a price feed, bbquotefeed[.]bitpo[.]online, named in both the AVAL and FTZCOIN app bundles. Certificate logs show the backend domains ussgo[.]com, trustwalletai[.]net and toptagx[.]net using the same set of subdomain names behind a brand prefix (for example avaagentpc, tragentpc, cfagentpc).

AVENNI and BCLR rest on the title template plus the site layout or brand name only (medium confidence); the other links rest on the app code and backend hosts (high confidence). As with the first kit, a shared kit does not mean a shared backend or operator.

Three FBI seizure notices

On Oct 25, 2026, Cloudflare's public DNS showed avalcoin[.]com, ftzcoin[.]com and ofdd[.]com on the name servers ns1 and ns2.fbi.seized[.]gov, and all three home pages returned a page titled "This Website Has Been Seized".

• avalcoin[.]com was the earlier AVAL domain. Its banner states that the domain "has been seized in accordance with a seizure warrant" issued by the United States District Court for the District of Columbia, as "part of a joint law enforcement operation conducted by Operation Level Up and the Scam Center Strike Force, which are initiatives of the Department of Justice, U.S. Attorney's Office for the District of Columbia, the Federal Bureau of Investigation, and the U.S. Secret Service." The ftzcoin[.]com and ofdd[.]com pages carry the same banner. The live AVAL site at avalcoinpro[.]vip calls the same backend hosts on ussgo[.]com that the archived avalcoin[.]com app called.
• ftzcoin[.]com was the FTZCOIN brand. An archived copy of its app (Wayback Machine, Mar 10, 2026) calls ftzdataapi[.]91yzbao[.]com, the same backend the FTZINC brand at ftzcoininc[.]com used in October 2026. A Wayback capture from Jul 28, 2026 already shows the seizure page.
• ofdd[.]com is the backend domain in an archived copy of the USSGO app (gotradedata[.]ofdd[.]com, Wayback Machine, Jul 14, 2025).

ussgo[.]com is not seized. It sits on ordinary Cloudflare name servers and now carries the AVAL backend. The other backend domains, bitcoinloaner[.]net, 91yzbao[.]com and toptagx[.]net, also show no seizure notice. On Oct 25, ftzdataapi[.]91yzbao[.]com and trdata[.]toptagx[.]net still answered requests, and ftzdataapi[.]91yzbao[.]com returned the kit's fee table (USDT: minimum deposit 10, minimum withdrawal 50, fee 25).

What users have reported

• AVAL: a Reddit user wrote in r/CryptoScams on Sep 22, 2026 that Avalcoin lets users withdraw small amounts at first, then freezes their assets and gives made-up reasons for blocking withdrawals.
• FTZCOIN: a March 10, 2026 post in r/CryptoScams names pc[.]ftzcoin[.]com, says deposits had to be made in bitcoin through Cash App, and says the withdrawal fee was $25, matching the kit's USDT withdrawal fee of 25.
• USSGO: a Trustpilot profile for USSGO lists the site as pc[.]ussgo[.]com and marks it closed. Reviews dated August 2025 describe deposit-to-unlock demands: one says users were asked "to deposit 15% of a huge number to have access to the money", and another says withdrawals were refused while staff kept asking for further deposits.
• BITSET: a July 2, 2026 post in r/CryptoScams says contact began on WhatsApp and that, after a larger transaction, the user was told to pay "taxes" and other fees before the money could be accessed.

Following the BITSET money

The BITSET user post names a Bitcoin address, 195XgkMt…YWKB, as one the funds were routed through. On-chain it is a Binance deposit address: it received 17.51226 BTC in 37 payments between Dec 2, 2024 and Jul 21, 2026, and every coin was swept out within hours, directly or through one consolidation address, into the wallet Binance itself disclosed as its BTC hot wallet (bc1qm34l…7s3h). It is an exchange account, not the operator's own wallet.

What feeds it is more telling. 33 of its 37 payments came from four unlabeled wallets that work as one cluster. They sweep the same block in the same minutes on five occasions, and they collect, every week, from hundreds of reused deposit-style addresses:

Money reached those deposit-style addresses from exchange withdrawals and private wallets. They include customer withdrawals from an exchange hot wallet between October 2025 and May 2026; this does not implicate the exchange. The collectors also paid out to deposit addresses that sweep into wallets publicly labelled as Binance, OKX and Gate.

The tie between these four wallets and BITSET rests on the user post naming the Binance deposit address they fed, plus the flow pattern. That makes it medium-low confidence: the flows are certain, the attribution is not. The other two addresses in the post are Binance's disclosed hot wallet and a wallet in Binance's proof-of-reserves list, and are not scam wallets.

Takeaways

• Kit sites recycle wallets across brands. The cryptovos XLM wallet was listed for two other fake platforms in March 2024, about two and a half years before cryptovos[.]com was registered on Sep 5, 2026 (RDAP). Searching a deposit address you have been given is a quick check.
• The kit is widespread. As of Oct 25, 6:33 PM CT, 35 more sites on builds A, B and C and 49 sites on venanco[.]com's 2024 code had live sign-up pages.
• One counter means shared deposit handling. Three calm-ui brands that look independent issue memos from the same sequence on the same TON wallet.
• A seizure does not stop the kit. avalcoin[.]com, ftzcoin[.]com and ofdd[.]com are seized, while backend hosts for AVAL, NMGEE and FTZINC on other domains still answered on Oct 25.
• The pitch repeats. Small early withdrawals, then a larger deposit, then a "tax", "AML verification" or unlock fee before any money can leave. A real exchange does not charge a deposit to release your own funds.

If you lost money to any of these sites, report it to the FBI's IC3 and the FTC, and add the site and addresses to our free scam database so others can find them.

Related BlockintAI reports

• 33 more fake-exchange sites on the 'calm-ui' kit, including bcmex[.]io, binoter[.]io and alfobit[.]com
• 49 fake-exchange sites serving the 2024 code of venanco[.]com
• Deposit wallets of six 'calm-ui' kit sites, including cryptovos[.]com, coinsco[.]io and hederabit[.]com
• AVAL at avalcoinpro[.]vip uses the same backend API hosts as FBI-seized avalcoin[.]com
• NMGEE at nmgee[.]com and four more brands on the AVAL kit
• FBI-seized FTZCOIN site ftzcoin[.]com and earlier BITSET, USSGO and BCLR fronts on the same kit
• Takedown update: doostoken[.]com on registrar hold
• Seven more calm-ui sites, including doostoken[.]com, labswap[.]io, cryptovos[.]com and soinaxbit[.]com
• MindChain Swap, NarwhalSwap and ten more calm-ui sites
• Ten more calm-ui sites, including nexoex[.]io and coinsco[.]io
• DEXGETO and its deposit addresses, DetixBit, Charix

Sources

• Public explorers for the shared TON wallet (tonviewer, tonapi.io), the cryptovos XLM wallet (stellar.expert, Stellar Horizon API) and the cryptovos XRP wallet (XRPSCAN, XRPL public API), read Oct 25, 2026
• PCrisk, weyshare[.]com scam (Mar 20, 2024): https://www.pcrisk.com/removal-guides/29418-weyshare-com-scam
• PCrisk, venanco[.]com scam (Mar 20, 2024): https://www.pcrisk.com/removal-guides/29424-venanco-com-scam
• Wayback Machine, venanco[.]com sign-up page and /design_2/assets/js/app.min.js and sing-in.min.js (captures of Jun 6, 2024)
• urlscan.io public search for the app.min.js hash beginning 84c100eb, read Oct 25, 2026
• Reddit r/Crypto_Scam_Exchange, "New Scam Exchange" posts, June to October 2026
• mempool.space address pages for the four collector wallets and the Binance deposit address, read Oct 25, 2026
• Binance BTC wallet disclosure (Nov 10, 2022): https://www.binance.com/en/blog/community/our-commitment-to-transparency-2895840147147652626
• Wayback Machine, FTZCOIN app bundle /js/app.21b7bbe1.js on pc[.]ftzcoin[.]com (capture 20260310191928, Mar 10, 2026)
• urlscan.io, XNTWALL scan (Sep 28, 2026): https://urlscan.io/result/01a0e6d6-7c6f-7306-8972-1643015caa08/
• Reddit r/CryptoScams user posts about DEXGETO (Oct 18, 2026), Avalcoin (Sep 22, 2026), FTZCOIN (Mar 10, 2026) and BITSET (Jul 2, 2026)
• Trustpilot, USSGO profile and reviews (listed site pc[.]ussgo[.]com)