One Victim Report, 29 Live Fake Exchanges: Inside the Reusable Kit Behind Svgweb

BlockintAI · 2026-10-18T14:00:00.000Z

BlockintAI research. Site, DNS and registration checks were re-run on Saturday, October 17, 2026, between 8:55 AM and 8:57 AM Central Time (CT), and first made that morning between about 7:00 AM and 8:25 AM CT. On-chain balances were re-checked at 12:45 PM CT the same day. Times are CT unless marked UTC.

It began with a friendly message on LinkedIn. On October 14, 2026, at 5:24 AM CT, a Reddit user posted a long, careful account in r/CryptoScams of how a woman calling herself "Amelia Ellery" had walked them, step by step, into a fake crypto exchange. The last step was a link to open inside a crypto wallet app's built-in browser: svgweb[.]com.

BlockintAI followed that link. Svgweb is still online, and it is not a one-off. The software behind it, a fake-exchange kit whose back end calls itself "Rockie", is running on 29 live domains this morning under about 14 different brand names. Ten of those domains were registered in October 2026, the newest on October 16. Ten days before the victim's post, a press release placed through a paid newswire was already promoting Svgweb as an "AI quantitative exchange."

This is the story of one victim and one kit. The kit is evidently sold or shared, so the sites below share software, not necessarily operators. Nothing here shows that one gang runs all 29.

Key facts

"Amelia Ellery" and the wallet browser

The Reddit account is detailed and frank. Here is the path it describes.

• The approach. A woman "from London" wrote on LinkedIn that the user's profile kept appearing in her feed. They seemed to share an industry. After a few days she suggested moving to Telegram. The user refused once, then agreed.
• The life story. On Telegram came photos: her office, cafés, the view from a Canary Wharf apartment. She said she grew up in Toronto, worked as a designer and had a daughter living with her grandparents in Edinburgh. Later, a reverse image search matched every photo to the Instagram account of a woman in Denmark. The persona was built from someone else's pictures.
• The aunt. She said her aunt ran an agency with a large team that analyzed the crypto market, and that she made a living from its tips. Would the user like to try one trade, Bitcoin to USDC, at a time the aunt had picked?
• The route. Buy Bitcoin on a mainstream Bitcoin app. Move it to a self-custody wallet app. Use that wallet's built-in "browser" to open a link she sent, a path on svgweb[.]com.
• The warning. A red scam warning appeared the moment the site opened. She said that was normal and to ignore it.
• The setup. "Support" on the site supplied a deposit address, and the user moved their Bitcoin there. The site then asked them to "identify" with a passport.
• The wins. After a video call that made her seem real, she guided two trades a few days apart. The site showed a profit of about €400.
• The test. She suggested a small withdrawal "to test the process." About €50 arrived. The rest was left on the site for the next "good trade."
• The push. The aunt was "retiring soon," so if they wanted more profit, the amounts had to go up. The user agreed to add €2,500, but the bank transfer was not instant and never reached the scheme.
• The block. When the user tried to withdraw, "Support" said two more trades of at least 100 USDC were needed first. After those, the withdrawal failed again, this time over "security checks." Then came a demand for a "security deposit" equal to the withdrawal amount. The user didn't pay.
• The end. Her LinkedIn profile disappeared. Days later she returned, offended, and suggested the user buy €3,000 more Bitcoin for her to manage. When that failed, she deleted the Telegram chat. The user kept screenshots, filed a police report and put their loss at roughly €1,000.

The victim's report gives two Telegram usernames for the persona, lucky0505cky and afei22444. The name, photos and backstory may be reused with other targets.

What svgweb[.]com shows

A gate before the exchange. Svgweb's front page is not an exchange. It is a dark loader marked "WEB3" that fingerprints the browser with FingerprintJS v3, computes a signature in WebAssembly, asks its server for the site's configuration under a key called domainNameCode, and shows a slider captcha. Only after that does it hand over main.html, a "Cryptocurrency Exchanges" web app with markets, spot and futures trading, "Finance" products and an "ICO" page. A captcha gate like this keeps automated scanners away from the scam pages while a victim, guided by chat, simply drags the slider.

Wallet-browser ready. The app carries deep links that open it inside the built-in browsers of six popular wallet apps, plus a live-chat support widget. Wallet browsers suit the scam: there is little of the familiar address bar to check, and a guide in chat can explain away any warning.

An ID page. All 28 app files that loaded include an identity page at #/identity, and in the victim's account the site had them "identify" with a passport after depositing. A trading site you reached through a chat has no use for passport photos. Collecting them gives the operators material for identity theft and for the next round of "verification" pressure.

Deposit pages that hand out addresses. The kit's deposit page lists a currency, a network and an address with a QR code. On October 17, Svgweb's deposit page displayed addresses for Bitcoin, Ethereum and USDC (ERC-20), and Solana. A "Common problem" box on the same page asks "Why is my deposit being reviewed?", which prepares the user for funds that never show up. The addresses are listed under "The money" below.

Three copies of Svgweb

Searching urlscan.io for Svgweb's app file found three more domains serving it byte for byte (static/js/app.1789806103721.js, SHA-256 4f4a9a4e4774a09b69574a72d34789aada0bea2ad506f1fc5c9eb09c64b3eea6). All four use the same pair of Cloudflare name servers, major and rose, and the three live ones serve the same site icon.

• sgvweb[.]com and sgvwebs[.]com were registered at NameSilo 26 minutes apart, at 8:09 PM and 8:35 PM CT on September 17, 2026 (01:09:57 and 01:35:43 UTC on September 18).
• svgweb[.]com itself is an old domain, first registered in 2006, at Gname. Its registration record last changed at 7:37 AM CT on September 18, the morning after the two lookalikes were registered.
• svgwebx[.]cc followed at Dominet (HK) at 11:36 AM CT on September 30, 2026.
• sgvweb[.]com served the same app in a urlscan.io scan on September 25. It was put on clientHold (record last changed 1:04 AM CT on September 29) and no longer resolves. Its twin sgvwebs[.]com, registered 26 minutes later, is still live.

A press release placed through a paid newswire. On October 4, 2026, a press release placed through Times Newswire, a paid newswire, and republished on several press-release sites called Svgweb a "leading AI quantitative exchange." It claimed a "Platform Launch" in July 2022, "Global Regulatory Licenses" in October 2023 and customer service "covering more than 20,000 users worldwide." The registration records tell a shorter story: the lookalike copies were registered on September 17, 2026, and svgweb[.]com's own record last changed the next morning.

One domain went on hold; two others carried on. Take-downs land one domain at a time, and replacements are cheap.

The kit and its fingerprints

Svgweb's software is easy to recognize once you know what to look for. At 8:55 AM CT on October 17, BlockintAI fetched each site's front page, main.html and app file.

• The "Rockie" API. All 28 app files that loaded call a back end under /exchange with "Rockie" controllers: RockieGoldETFController and RockieMessage appear in every one, and 26 also carry RockieAiController and RockieGoldNewStockController. The 29th site, coincaks[.]com, serves the same loader but hides main.html behind a Cloudflare "Suspected Phishing" page.
• The loader. Every one of the 29 front pages carries the same slider-captcha loader with the domainNameCode lookup. Six of them serve a byte-identical loader page (SHA-256 f7feb848f27b75fdc6675835ca52da3fa0a5dcdad1699e318e15690561eb4859): the three live Svgweb domains, both oakwaver domains and bitdao[.]top.
• The icon. 26 of the 29 sites serve the same default favicon (mmh3 hash 1392309695).
• The tracking pixel. 20 of the 28 readable main.html pages initialize the same Facebook pixel, 960774776023646, across many brands. A pixel shared by that many unrelated brand names points to a value baked into the kit, not to a single operator.
• The ID page. All 28 app files include the /identity route.

Some sites go further and serve the same build on more than one domain, the strongest pairings in the set:

Some pairs were registered together at different registrars. oakwaver[.]cc (Dominet (HK)) and oakwaver[.]co (NameMart) were registered 21 seconds apart at 12:46 AM CT on October 3, 2026. cryptocexchangse[.]cc (Dominet (HK)) and cryptocexchangse[.]com (NameMart) were registered 12 and a half minutes apart on July 28, 2026. Splitting a pair across two registrars means a complaint at one doesn't take down both.

The brand roster

The front ends change; the software underneath does not. Brands on the live sites this morning:

• Svgweb: the victim's platform and its two live copies
• Coincake, plus a lookalike domain, coincaks[.]com
• CRYSTAL BEST ("Born for trading"), and an unbranded copy of the same template on the two oakwaver domains
• Curve DAO: a lookalike of the decentralized exchange, on three domains
• A Uniswap lookalike on three domains
• Oakwave Markets on three domains, all registered between October 8 and October 11
• ICGGlobal on two domains
• HRT SAE
• GMO: a lookalike of the Japanese financial group, at main.gmoexdo[.]com
• "Web3.0 / Stock / Forex / ETF" ("Let AI provide you with more effective…"), including on coinbaseai[.]ai, a Coinbase lookalike domain
• Hyperplans at bitdao[.]top
• "Cryptocurrency Exchanges" on two domains
• Two more sites behind browser warnings: hyperliquid[.]xin, a Hyperliquid lookalike domain, and bartonlab[.]com, an older domain first registered in 2019

A further kit domain, okxhy[.]cc, registered at Dominet (HK) in May 2026, was recorded as an OKX lookalike and now has no DNS.

The October burst

Ten of the 29 live domains were registered in the first half of October 2026, at a pace of more than one new domain every two days:

Four more, including two of the Svgweb copies, were registered between September 15 and 30. Ten were registered between January and August 2026. Four were registered before 2026 (svgweb[.]com in 2006, bartonlab[.]com in 2019, coinbaseai[.]ai in 2024 and coincake[.]org in December 2025) and now point to the kit. The registration date of coincake[.]com.mx is not published.

Already flagged, still online

At 8:57 AM CT on October 17, Google's Safe Browsing status (via the Google Transparency Report) listed 9 of the 29 sites as dangerous: sgvwebs[.]com, svgwebx[.]cc, bartonlab[.]com, bifanxa[.]ink, oessal[.]com, hedrser[.]net, hyperliquid[.]xin and oakwavemar[.]top, with some pages on bitdao[.]top flagged as well. Chrome shows a full-screen red "Dangerous site" warning on the eight fully flagged sites. Cloudflare shows its own "Suspected Phishing" page in front of the exchange on coincaks[.]com.

That leaves 19 of the 29 with no browser warning at all, including svgweb[.]com, the domain in the victim's report. A warning helps only where it is shown, and the victim saw one and was talked past it. All 29 sit behind Cloudflare. In four of the shared-build groups (Svgweb, the Uniswap lookalike, Curve DAO and Oakwave Markets), flagged domains have an unflagged twin running the same build.

The money: what the chain shows

On October 17, 2026, the deposit pages of four kit sites (svgweb[.]com, coincake[.]org, cryptocexchangse[.]com and crystala[.]top) displayed 13 deposit addresses: Bitcoin, Ethereum and ERC-20 stablecoins, TRON (USDT), BNB Chain and Solana.

Twelve of the 13 hold no funds. The EVM addresses were checked on Ethereum, BNB Chain, Polygon, Arbitrum, Base and Optimism. The one exception is Svgweb's Bitcoin address:

bc1q9m3jfnn3f3ux0chdxnnlc7zkxlz8aa8e0s5krd received 0.02018659 BTC in two transactions on October 15, 2026, at 8:12 AM and 8:42 AM CT, both from one sending address. That was about $1,625 at the time, using mempool.space's BTC price of $80,497 for the hour both payments landed in (8:00–9:00 AM CT). None of it has moved: mempool.space showed the full balance unspent at 12:43 PM CT on October 17. The address was paid two days before the deposit page displayed it, so it is a standing address, not one generated on the spot.

Svgweb's Ethereum address names itself. On Base, 0x186e0F68e9d3Be5F95DecAA4456625e5b1ab984B registered the Basename svgweb.base.eth to itself at 2:42 PM CT on September 17, 2026 (19:42 UTC). That was the same day the lookalike domains sgvweb[.]com and sgvwebs[.]com were registered, starting at 8:09 PM CT. The name both belongs to the address and points back to it, and BaseScan displays the address as svgweb.base.eth. Apart from that name and two unsolicited spam-token drops (75 "FAFNIR" in total, worth nothing), the address has received nothing on any chain checked.

There are no shared consolidation wallets and no shared gas funders among the four sites, and no on-chain link to any other cluster BlockintAI tracks. The tie between these sites is the software and the registration patterns, not the money.

Red flags in this script

• A stranger on LinkedIn who moves you to Telegram. A shared industry and a steady stream of photos are props.
• A relative with "insider" trading tips. The aunt, uncle or mentor with a team of analysts is a stock character. Nobody with a real edge needs your money.
• "Open this link in your wallet's browser." Real exchanges don't ask you to reach them through a wallet app's built-in browser. That route skips the address bar you would normally check.
• A warning you are told to ignore. If your browser or wallet shows a red scam warning, believe it. "That's normal" is the scammer talking.
• A "WEB3" slider before the site loads. It keeps scanners out, not thieves.
• A passport upload for a site a chat contact sent you to. A fake exchange has no use for your passport except identity theft and more pressure later.
• A small test withdrawal that works. It exists to win trust for the bigger deposit.
• New conditions at withdrawal time. "Two more trades," "security checks," a "security deposit," a tax or an unlock fee: each is a reason to stop, not to pay. Anyone who then offers to recover your money for a fee is running the next scam.
• Report it. In the U.S., report fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Elsewhere, report to your national police cybercrime unit. You can also file a report at blockint.ai with the domains, chat usernames, deposit addresses and transaction hashes. It is free, and anonymous reports are accepted.

Related C3 reports

BlockintAI has filed C3 reports for Svgweb and for each brand on the same kit. The brand reports share the software only; no common operator is claimed.

• Svgweb: svgweb[.]com, sgvwebs[.]com, svgwebx[.]cc, sgvweb[.]com
• Coincake: coincake[.]org, coincake[.]com.mx, coincaks[.]com
• "Cryptocurrency Exchanges": cryptocexchangse[.]com, cryptocexchangse[.]cc
• CRYSTAL BEST: crystala[.]top
• Curve DAO lookalike: curvedai[.]co, oessal[.]com, hedrser[.]net
• Oakwave Markets: ngersah[.]net, oakwave[.]click, oakwavemar[.]top
• "Born for trading": oakwaver[.]cc, oakwaver[.]co
• ICGGlobal: icgpacific[.]cc, lkesd[.]com
• "Web3.0 / Stock / Forex / ETF": coinbaseai[.]ai, ethaigood[.]com
• Uniswap lookalike: bifanet[.]com, bifanxa[.]ink, decentralizedj[.]cc
• HRT SAE: hrcke[.]com
• GMO lookalike: gmoexdo[.]com
• Hyperplans: bitdao[.]top
• hyperliquid[.]xin
• bartonlab[.]com
• OKX lookalike (offline): okxhy[.]cc

Sources

Victim account

• Reddit r/CryptoScams, "got scammed by pig butchering," posted Oct 14, 2026, 5:24 AM CT: https://www.reddit.com/r/CryptoScams/comments/1x5nmrd/got_scammed_by_pig_butchering/

The sites (public pages; checked Oct 17, 2026, 8:55 AM CT)

• Front-page loader, main.html and static/js/app.<build>.js on each host listed above
• Kit search: urlscan.io public search for the Svgweb app file and the RockieMessage path: https://urlscan.io/
• Press release, Times Newswire, Oct 4, 2026 (placed through a paid newswire): https://www.timesnewswire.com/globalenglish/svgweb-using-an-ai-quantitative-exchange-as-a-pivot-to-unlock-the-web3-0-aggregated-ecosystem/
• Browser warnings: Google Transparency Report, Safe Browsing site status (8:57 AM CT): https://transparencyreport.google.com/safe-browsing/search

Registration and DNS

• RDAP for .com and .net (Verisign): RDAP record for svgweb[.]com; the same path works for each .com domain above
• RDAP for other domains (rdap.org bootstrap): RDAP record for svgwebx[.]cc
• DNS over HTTPS (Google Public DNS): A lookup for svgweb[.]com

On-chain (checked Oct 17, 2026, 12:43–12:50 PM CT)

• mempool.space (Bitcoin; the BTC price is mempool.space's hourly historical price): bc1q9m3jfnn3f3ux0chdxnnlc7zkxlz8aa8e0s5krd, with payments dafed4c1…ae714 and adb1b958…ad8de; bc1qxskz8nc9dr5tm4jjxgftd40w2c8g3j0ptxlye9; bc1qx3k7rfvpaq7zj339tzudvu0n7s0rx4nn0mec94
• Etherscan (Ethereum): 0x186e0F68…b1ab984B, 0xd2a4b2d3…8C982291, 0x3C025CF0…3872f678, 0x4c12A6CE…94474152, 0xaD2b36ed…259930F3, 0xfEa271B5…418B88c7
• BscScan (BNB Chain): 0x6499CCCA…6DAc8e77
• BaseScan and Basenames (Base): svgweb.base.eth / 0x186e0F68…b1ab984B, Basename registration transaction, base.org/name/svgweb
• Tronscan (TRON): TCjFFzpA93jauJGAgoV9D38vEacZWRa82s
• Solscan (Solana): AdUcw3Yo…qYovFEx8, 6sQccK7g…oEz9wuTXQuV
• Polygon, Arbitrum and Optimism balances: public RPC nodes and Blockscout, same time