blockintAI · Research blog

One Fake-Job Scam Kit, 20 Sites, 13 Borrowed Brand Names: How the 'Order Task' Trap Works, and 9 Sites Still Live

BlockintAI · 2026-10-24T00:26:38.431Z

A fake-job scam kit is running on 20 websites that use the names of 13 real businesses, most of them marketing agencies. The sites present themselves as a work portal for the named company. They aren't. They follow the "order task" pattern the FBI has warned about: you're shown commissions for clicking through tasks, until your account shows a negative balance that the site's own text says you must clear with a deposit. Some of the sites list USDT/USDC as the account currency.

We found the sites on October 21, 2026 and filed our report the same day, along with abuse reports to the registrars and hosts. This post explains how the kit works, how to spot it, and where things stand. We checked every site again at 7:16 AM CT on Friday, October 23.

Key facts
Scam type Fake job / "order task" scam (task scam)
Sites 20 hostnames, same site software and API paths
Names used Inchcape, Jellyfish, Broken Heart Love Affair, Smartly, Bloom Consulting, Domain Coasters, AlphaZeta, Xplora, Spicy Tiger, Pixite, Smith Brothers Media, Pirawna, Savage Global Marketing
Payment Deposits and "top-ups"; nine sites list USDT/USDC as the account currency (as captured Oct 21)
First checked October 21, 2026 (all 20 live at 3:29 PM CT)
Status at 7:16 AM CT Oct 23 7 on registrar hold, 2 showed a Cloudflare phishing warning page when we visited, 2 not resolving, 9 live
BlockintAI report Fake-job 'order task' scam kit on 20 sites using real brand names

The brands are real. The sites aren't theirs.

The names on these sites belong to real companies. Inchcape is a global car distributor. Jellyfish, Pixite and most of the others are marketing or advertising agencies, Smartly makes advertising software, Bloom Consulting is a place-branding consultancy, and Domain Coasters sells expired domains. Each site uses the name of one of them. Nothing we found suggests any of these businesses is involved. The sites appear to use known names because a job with a known agency sounds believable.

The domains follow one formula: the brand name plus a short add-on such as "ppc", "hex", "data", "sub" or "service". For example, inchcapedata[.]biz, jellyfishhex[.]com and smartlyservice[.]biz. A company's own staff portal would normally sit on its own domain.

At least one of the companies has already warned the public. Xplora BG, a Bulgarian agency, posted on September 4, 2026 that its name was being used without its permission on scam websites, including xplorappc[.]com and xplorappc[.]info, two of the 20 in our report. It says it will never ask anyone to cover a "negative balance".

How the "order task" trap works

The sites share the same app structure and API paths. We read the public app code and the public API, which returns each site's levels, rules and "About" text.

1. A recruiter offers easy remote work. The FBI says these scams usually start with a post or text on social media or SMS, then move to WhatsApp or Telegram, offering remote work on simple, often click-based tasks. IC3 notes the work is often described as "optimizing" a service.

2. You sign up on the "company" site. You get a dashboard with a balance, a level and a list of tasks. Each site's API lists membership levels by minimum account balance and commission rate. On the Broken Heart Love Affair-named site, the four levels are 101, 1,000, 3,000 and 10,000 USD, each at 0.5% commission.

3. Early tasks seem to pay. You click through "orders" and your balance grows. The FBI notes that scammers commonly allow early withdrawals, so victims believe they are making a profit.

4. A "high-profit" task pushes you negative. This is the trap. The kit's own text, from the brokenheartloveaffairppc[.]com site's About page:

"If a negative number appears due to high-profit tasks during the process the commission will also increase."

To keep going, and to get your money out, you have to deposit enough to clear the negative balance. The FBI lists exactly this as a warning sign of cryptocurrency job scams: a promise "that when a negative balance shows up, you'll receive a much larger commission."

5. "Reset" your account with more money. On 18 of the 20 sites (as captured Oct 21; we re-confirmed all 9 live sites on Oct 23), the About text tells users to "reset" their work account with a deposit. The Inchcape-named site says:

"Please choose your account reset amount wisely based on your financial situation."

The Pirawna-named site says "reset your account based on your actual financial situation". A real employer never asks you to choose how much of your own money to pay in.

6. Top-up "rewards". The Inchcape-named site dresses the deposits up as bonuses. If "more than two promotional orders appear within the same task group and the required top-up exceeds $50", it says, users "may receive additional subsidy rewards" of $300 or $500. The promised rewards are tied to larger top-ups.

7. The exit closes. The app code on all 20 sites (as captured Oct 21; re-confirmed on 5 of the 9 live sites on Oct 23) contains messages such as "Unable to match product, please contact customer service" and "Low credit scores prevent you from pulling money". They read as reasons a withdrawal won't go through, and they send you to "customer service", which the FBI lists as a feature of these scams.

The FBI and IC3 have warned about this pattern since at least June 2024, when IC3 warned that fake work-from-home jobs built around simple tasks use a "confusing compensation structure" that "requires victims to make cryptocurrency payments in order to earn more money or 'unlock' work" (PSA I-060424-PSA).

What the 20 sites have in common

Several shared details link the 20 sites:

  • Shared assets. On October 23, 8 of the 9 live sites loaded their logo from one Alibaba Cloud storage bucket, osswotlk.oss-ap-northeast-1.aliyuncs[.]com (the ninth sets none), along with their level icons, and all 9 use the same /frontend/ API paths.
  • Batch registration. Per the public domain registration records (RDAP), seven of the domains were registered seconds apart: four on September 11, 2026 at 09:41:40–41 UTC and three on September 26 at 09:48:03–05 UTC.
  • Shared hosting. When we first checked on October 21, 11 hosts resolved to Tencent Cloud and 9 sat behind Cloudflare. Of the 9 still live, 7 are on Tencent Cloud and 2 behind Cloudflare.
  • Same registrars. Gname registered 10 of the domains, Unstoppable Domains 5, Gransy 2, and GMO (Onamae), Cosmotown and Dynadot one each.

These are shared tools and shared hosting. A shared kit isn't proof that one person or group runs all 20 sites, and we don't claim that.

Where the 20 sites stand on October 23

We sent abuse reports to the registrars, Tencent Cloud and Cloudflare on October 21 between 4:06 and 4:26 PM CT. Here's what we found at 7:16 AM CT on October 23:

On registrar hold, no longer resolving (7): inchcapedata[.]com and work.savageglobalmarketingdata[.]com (Gransy), domaincoastershex[.]com, xplorappc[.]info, xplorappc[.]com, alphazetadata[.]com and alphazetasub[.]com (Unstoppable Domains). RDAP shows a registrar hold on each. No registrar or host has told us whether our reports played any part.

Showed a Cloudflare "Suspected Phishing" warning page when we visited on October 23, 2026 (2): smartlyservice[.]biz, bloomconsultingsub[.]info. We don't know what prompted the warning.

Not resolving, no hold (2): bloomconsultinghex[.]com (GMO), jellyfishdata[.]biz (Gname). These have no web address record right now but could come back.

Still live (9):

  • brokenheartloveaffairppc[.]com
  • inchcapedata[.]biz
  • spicytigersub[.]com
  • jellyfishhex[.]com
  • pixitehex[.]com
  • smithbrothersmediadata[.]com
  • work.pirawnadata[.]com
  • domaincoastersdata[.]com
  • work.savageglobalmarketingdata[.]biz

On the live sites, the kit's API still serves the same levels and About text. Seven of the nine live domains were registered through Gname; the other two through Cosmotown and Dynadot.

How to protect yourself

  • A job that pays you to click "orders" or "optimize" products is a scam. Real employers don't run task dashboards with balances and levels.
  • You never pay to work. Any request to deposit, "top up", "recharge" or "reset" your account, in crypto or otherwise, is the scam itself.
  • A negative balance is the trap, not a glitch. Stop, and don't pay to clear it.
  • Check the domain. If a "company portal" lives on a brand name plus ppc, hex, data or sub, it's not the company's. Look up the real company's website yourself.
  • Recruiters on WhatsApp or Telegram who found you first are the most common way in.

If you've been targeted or lost money, report it to ic3.gov and the FTC, and file a report at blockint.ai so the next person can find the site before they pay.

Sources