blockintAI · Research blog

Three Mirrors, Two Deposit Addresses: Following the Money From the 'J·B·G·AG' Fake Exchange

BlockintAI · 2026-10-23T20:00:00.000Z

BlockintAI research. Site, registration (RDAP) and DNS checks were run on Thursday, October 22, 2026, between 7:07 and 7:10 AM Central Time (CT). On-chain figures come from public Bitcoin and TRON data (mempool.space, TronGrid and Tether's USDT contract on TRON), re-checked the same morning between 7:04 and 7:08 AM CT. Times are CT unless marked UTC.

The site calls itself J·B·G·AG. It looks like a crypto exchange: a green mobile-style app with live-looking coin tickers, a menu offering "Pledge mining," "Financing," "Second contract" and "U-standard contract," and big buttons for "Quick coin charging" and "Quick withdrawal of coins." It runs on three domains, www.jbgags[.]com, www.jbgags[.]top and www.jbgags[.]vip, which serve the same app, byte for byte.

What it doesn't show is anyone behind it. No public page names a company, a licence, a regulator, an address or a country, and that includes its Terms of use. Its deposit page doesn't credit money from the blockchain. It asks the payer to upload a screenshot.

On October 21, 2026, the site's deposit page displayed a Bitcoin address and a USDT (TRC-20) address. BlockintAI followed both. The Bitcoin trail is short and recent: three payments, about $14,260, each moved on within 9 minutes to about 25 hours through a chain of hop addresses into one large wallet. That wallet now holds 2.118 BTC, but it is not J·B·G·AG's own sweep wallet. It is a downstream wallet that also received money from many other sources, starting nine months before the deposit address was ever used.

Key facts
The site "J·B·G·AG," a fake crypto exchange app on www.jbgags[.]com, www.jbgags[.]top and www.jbgags[.]vip. No company, licence, regulator or address on any public page, including its Terms of use
The domains All three registered at Xin Net Technology Corporation on Nov 23, 2025, within nine seconds (05:00:22 to 05:00:31 UTC). One TLS certificate covers all three. One server: 154.198.49[.]53, Antbox Networks Limited (AS138995), Hong Kong
Deposit addresses On Oct 21, 2026, the site's deposit page displayed BTC bc1pyrg6xzylv2h3uf2xu4ffnfu2fa6pmq36prvrh6u4rwqxlpmyjjas9wxq43 and USDT (TRC-20) TCQy9D5WotwBKRGtrv7HGyrgU6i7z77tjc. An Ethereum address it displayed has never been used
Bitcoin in 0.17449311 BTC in three payments, Oct 12–19, 2026, about $14,260 at the time of each payment. Balance 0
Bitcoin out Each payment left the deposit address within 9 minutes to about 25 hours, then passed through three to five intermediate addresses into one downstream wallet, which received it on Oct 13 and Oct 20
The downstream wallet bc1pt4fcgq…vn72p2: 69 incoming payments from 30 sending addresses since Jan 6, 2026, 8.60 BTC received in all, 2.11807723 BTC unspent (about $173,200 at 7:04 AM CT, Oct 22). It also received money from many other sources; it is not the site's own sweep wallet
USDT 45,524.83 USDT received in 25 transfers from 5 sending addresses (May 11 – Aug 19, 2026), all of it sent on to 99 addresses by Aug 29. Balance 0
Freezes and sanctions None. Tether has not blacklisted the USDT address or its main counterparties, and no address in this post is on OFAC's sanctions list (Oct 22, 2026)
Status Reported to Xin Net (9:11 AM CT) and Antbox (9:20 AM CT) on Oct 21, 2026. As of 7:07 AM CT on Oct 22, all three registrations are active with no hold, and www.jbgags[.]com and www.jbgags[.]top still load. www.jbgags[.]vip no longer resolves

A full exchange menu, and nobody behind it

On the morning of October 21, 2026, the J·B·G·AG homepage showed the standard furniture of a crypto platform: BTC, ETH and gold tickers, a "Popular coins" list, and a grid of products, "Pledge mining," "Deposit," "Financing," "Withdraw," "Convert," "Second contract," "U-standard contract" and "Spot." Below them sat "Quick coin charging," "Quick withdrawal of coins" and an "Online Service" button. The logo reads "JUB."

The tickers track real market prices, so they prove nothing either way. What matters is what's missing. A real exchange tells you who runs it and where it is licensed, because regulators require it. J·B·G·AG's Terms of use are a generic user agreement with no operating company, no jurisdiction and no licence. No other public page fills the gap.

The deposit page is the clearest tell. On October 21, under "Recharge BTC," it displayed a QR code and the "Recharge address (BTC)," then two fields: "Recharge amount" and "Upload screenshot of payment details," with a "Confirm recharge" button. A real exchange sees your deposit on the blockchain and credits it automatically. A site that asks for a screenshot instead suggests balances are credited by hand, in a database the operator controls. Whatever number shows in an account there can be whatever the operator types in.

BlockintAI saw the same pattern on the Velxton site, whose deposit page asked for a "proof of transaction" upload (our Velxton and Lexor Finance post).

Three domains, nine seconds, one server

The three names were bought together. Registration records (RDAP) show jbgags[.]com registered at Xin Net Technology Corporation at 05:00:22 UTC on November 23, 2025, jbgags[.]top three seconds later and jbgags[.]vip six seconds after that. All three use Xin Net's DNS service.

They also share everything else. One TLS certificate, issued by Let's Encrypt on October 11, 2026, covers www.jbgags[.]com, www.jbgags[.]top and www.jbgags[.]vip together; an earlier certificate from TrustAsia, issued September 13, 2026, covered the same three names. All three point to one server, 154.198.49[.]53, on Antbox Networks Limited (AS138995) in Hong Kong, with no content-delivery network in front. The app's back end runs on a separate host, webapi.hjuing[.]cn, which points to the same server.

The setup has moved before. A public urlquery.net scan of www.jbgags[.]com on December 30, 2025, shows the same "J·B·G·AG" title on a different Antbox address, 45.125.219[.]73, with its back end on another domain, webapi.kaixinkuailemeiyitian[.]cn. The name stayed the same while the server and the back-end domain changed.

Is this a kit we've covered? No. BlockintAI compared J·B·G·AG's files with the fake-exchange kits in our earlier posts: DEXGETO and its "AML verification" kit, the AXIO/Benthorne kit, the Svgweb "Rockie" kit and the Worldex mirror network. J·B·G·AG matches none of them. It is a different app build with its own file layout and back end.

It does share code with other exchange brands, though. Its main third-party code file (vendor-cdb74f29.js, SHA-256 85225714…5b83e, re-checked at 7:10 AM CT on October 22) is byte-identical to the one served by several other exchange sites. One of them, www.colndase[.]com, sat behind Cloudflare's "Suspected Phishing" warning at 7:10 AM CT on October 22. A shared code file means shared software, not necessarily a shared operator.

The Bitcoin deposit address: three payments in eight days

The Bitcoin address the deposit page displayed, bc1pyrg6xzylv2h3uf2xu4ffnfu2fa6pmq36prvrh6u4rwqxlpmyjjas9wxq43, has five transactions in all: three in, two out. As of 7:04 AM CT on October 22 it held nothing.

Received (CT) Amount About (USD at the time) Shape of the payment
Oct 12, 2026, 6:20 PM 0.06725389 BTC $5,521 One transaction combining 16 coins from 8 addresses into a single output
Oct 18, 2026, 4:46 PM 0.04647858 BTC $3,760 Two inputs, two outputs
Oct 19, 2026, 5:03 PM 0.06076064 BTC $4,979 One line in a 117-output batch payout
Total 0.17449311 BTC about $14,260

The October 12 payment is unusual. It wasn't a single person sending money; it was a wallet sweeping up 16 small coins from 8 of its own addresses and paying the whole lot to the deposit address. Because a Bitcoin transaction needs the keys for every input it spends, all eight addresses were almost certainly controlled by one wallet. Nine of the 16 coins came from bc1ptc6jjryf6vuc28krzd5rfnd8ryukeuw2k03eywn3l2y07zmqwqtsjwdqg5, an address that received 0.80 BTC in 35 payments between September 25 and October 16, 2026, and whose outgoing payments went to some of the same addresses this trail passes through below. The deposit address's first money came from a wallet that was already feeding the same pipeline.

The October 19 payment is a single line in a batch of 117 payouts, the shape of a large service paying many customers at once. The sender carries no public label, so BlockintAI isn't naming it.

Where the Bitcoin went

The money didn't sit. The October 12 payment left nine minutes after it arrived. The October 18 and 19 payments were moved together, in one transaction about an hour after the second one landed. From there, both strands took separate routes that end in the same place.

Route 1: the October 12 payment (six hops in under six hours). Each step sent almost all of the money on, shaving off a small side payment at most steps. Two of these addresses, bc1pf3s7ae…mj27y and 19UR1SG3…pfBjm, also received other payments, including from the bc1ptc6j…dqg5 address described above.

Time (CT) From To Amount moved on
Oct 12, 6:29 PM Deposit address bc1pwnm773…gslz7 0.06701735 BTC
Oct 12, 8:49 PM bc1pwnm773…gslz7 bc1pyx2ms8…g67x 0.06551827 BTC
Oct 12, 10:30 PM bc1pyx2ms8…g67x bc1pqtpa4q…j5vt 0.06409273 BTC
Oct 12, 11:56 PM bc1pqtpa4q…j5vt bc1pf3s7ae…mj27y 0.05800000 BTC
Oct 13, 12:08 AM bc1pf3s7ae…mj27y 19UR1SG3QnsAK2nPGmFhncnxuf9mnpfBjm 0.05799492 BTC
Oct 13, 12:08 AM 19UR1SG3…pfBjm downstream wallet bc1pt4fcgq…vn72p2 0.05799290 BTC

Route 2: the October 18 and 19 payments (four hops in about 17½ hours, mixed with other money).

Time (CT) From To Amount moved on
Oct 19, 6:04 PM Deposit address 1Jsj3TdKBZkDupmHotBU4iXKK4ALDwGDCc 0.106 BTC (plus 0.0012 to a fresh address)
Oct 19, 6:52 PM 1Jsj3TdK…GDCc bc1pf3s7ae…mj27y 0.54470572 BTC. This includes 0.43870923 BTC that 1Jsj3TdK received at 2:39 PM CT the same day from a separate 33-output batch payout
Oct 20, 11:07 AM bc1pf3s7ae…mj27y bc1pfe5d58…hfvdce 0.54469216 BTC
Oct 20, 11:36 AM bc1pfe5d58…hfvdce downstream wallet bc1pt4fcgq…vn72p2 0.54468883 BTC

The address bc1pf3s7ae…mj27y appears on both routes. It isn't a one-off hop. Between October 7 and 21 it handled 1.14 BTC in six in-and-out rounds, each usually passed on within minutes, and its other inflows came from the bc1ptc6j…dqg5 address described above and from other hop addresses in the same pattern.

The downstream wallet: 2.1 BTC, and not only from this site

Both routes end at bc1pt4fcgqlvrxkshjmxyj65utgsmv03atg5qzas0fn5f6fp2p5jvc9qvn72p2. As of 7:04 AM CT on October 22, it holds 2.11807723 BTC in 11 unspent coins, about $173,200 at mempool.space's price of $81,775.

That figure should not be read as J·B·G·AG's takings. This is a downstream wallet that also received money from other sources:

  • It is older than the deposit address. Its first payment arrived on January 6, 2026. The deposit address's first payment arrived on October 12.
  • It has many feeders. It has received 69 payments from 30 sending addresses, 8.60 BTC in all. It has emptied itself six times, in single large transactions on January 27, February 15, March 4, March 16, June 27 and September 23, 2026, the last one sending 2.26 BTC to one address.
  • The traceable share is small. Of the 2.118 BTC it holds now, the two coins that trace back to the J·B·G·AG deposit address are 0.0580 BTC (October 13) and 0.5447 BTC (October 20). Only 0.106 BTC of the second coin came from the deposit address; the other 0.4387 BTC came from a separate batch payout. So roughly 0.16 BTC of its balance traces back to the site's displayed address.

What the wallet does show is a collection point that has been taking in money in the same hop-by-hop pattern for most of 2026 and is still doing it. Its latest payment arrived at 11:34 PM CT on October 20. No explorer BlockintAI checked carries a public label for it, and none of the addresses on either route has one. This is a description of where the money went, not an identification of who controls it.

The USDT address: in by the 2,000, out in small change

The USDT (TRC-20) address the deposit page displayed, TCQy9D5WotwBKRGtrv7HGyrgU6i7z77tjc, tells a different and older story. Every one of its 258 token transfers is real USDT, with no fake-token or zero-value "poisoning" transfers.

  • In: 45,524.83 USDT in 25 transfers, all of them $10 or more, from 5 sending addresses, between 9:17 AM CT on May 11 and 10:11 AM CT on August 19, 2026. One address, TELfRfXSG7F7JecTJp7qdxy9NiRfxPD5qS, sent 38,000 USDT in 19 transfers of exactly 2,000 USDT. A second sent 5,999 USDT in three transfers of about 2,000. The other three sent 865.83, 500 and 160 USDT.
  • Out: the same 45,524.83 USDT in 233 transfers to 99 addresses, by 12:12 AM CT on August 29, 2026. 226 of those transfers were $10 or more, sent to 94 addresses; the other seven totalled 34.45 USDT. The typical transfer out was 79 USDT. The largest recipient, TTm2S8QNgLKtpDx8Mif4nzbcX1DCSgzbum, took 12,546 USDT in 23 transfers.

That shape isn't a typical collection address, where many payers send in and one sweep goes out. This address was topped up in round 2,000-USDT lots, mostly from one address, and paid out in small amounts to dozens of others. It has been empty and idle since August 29, 2026, yet the site was still displaying it on October 21. Nothing on-chain links it to the Bitcoin trail above.

As of 7:06 AM CT on October 22, Tether's USDT contract on TRON shows the address and its main counterparties as not blacklisted (isBlackListed returns false), so none of this money has been frozen.

The Ethereum address the deposit page displayed for USDT (ERC-20) and ETH, 0x6061125E0f2B92B02FC653826d9DB54D890Ae2Cc, has never been used. It has no transactions and no balance on Ethereum, BNB Chain, Polygon, Arbitrum, Base or Optimism (checked 7:07 AM CT, October 22).

Reported, still online

BlockintAI reported jbgags[.]com, jbgags[.]top and jbgags[.]vip to the registrar, Xin Net Technology Corporation, and to the hosting network, Antbox Networks, on the morning of October 21, 2026 (Xin Net at 9:11 AM CT, Antbox at 9:20 AM CT).

As of 7:07 AM CT on October 22, none of the three domains has been suspended or put on hold. The registry records still show all three as "active." www.jbgags[.]com and www.jbgags[.]top still load the same homepage file on the same server. www.jbgags[.]vip still loaded on the afternoon of October 21 but had stopped resolving by that evening; its registration record is unchanged and shows no hold.

Domain Registrar (RDAP) Registered (UTC) Status, Oct 22, 7:07 AM CT
jbgags[.]com Xin Net Technology Corporation 2025-11-23 05:00:22 Active, no hold; www live on 154.198.49[.]53
jbgags[.]top Xin Net Technology Corporation 2025-11-23 05:00:25 Active, no hold; www live on 154.198.49[.]53
jbgags[.]vip Xin Net Technology Corporation 2025-11-23 05:00:31 Active, no hold; www no longer resolves

Red flags on sites like this

  • No company, no licence, no address. A real exchange tells you who runs it and which regulator licenses it. If the Terms of use don't name anyone, nobody is accountable for your money.
  • A screenshot instead of a blockchain. If a deposit page asks you to upload proof of payment, the balance you see afterwards is whatever the operator decides to type in.
  • Mirror domains. The same site on .com, .top and .vip names bought seconds apart lets an operator keep going when one name is taken down.
  • Exotic products. "Pledge mining," "Financing" and short-term "contracts" are common on fake platforms, where any profit shown is just a number in the operator's database.
  • Fees to withdraw. If a platform asks for a "tax," "verification" or "unfreezing" payment before you can withdraw, the money is already gone. Don't pay it.
  • "Recovery" offers. Anyone who contacts you offering to recover your money for a fee is running the next scam.
  • Report it. In the U.S., report fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Elsewhere, report to your national police cybercrime unit. If you've been scammed, you can also file a report at blockint.ai with the website, chat names, deposit addresses and transaction hashes. It's free, and anonymous reports are accepted. Keep the transaction hashes of your own payments and the exact deposit address you were given; that's what investigators need.

Sources

Bitcoin (mempool.space, re-checked Oct 22, 2026, 7:04–7:08 AM CT)

TRON and Ethereum

Sanctions

Domains, hosting and site