weareoxis[.]com, globaxio[.]com: 2024-version kit fake exchanges on cryptovos[.]com's XRP/XLM memo counters and a 2024 Monero wallet; 22 new addresses
- Scam type: Scam
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Weareoxis / Globaxio (venanco-generation fake-exchange kit, deposit wallets shared with cryptovos)
- Incident date: 2026-10-25
- Reported: 2026-10-26
- Last updated: 2026-10-26
These are the deposit addresses shown on the logged-in deposit pages of weareoxis[.]com and globaxio[.]com, two fake cryptocurrency exchanges running the 2024 generation of the kit (the same code as venanco[.]com's 2024 site) and sharing deposit wallets with cryptovos[.]com. A research account was opened on each site on 2026-10-25, and every address below was copied from the site's own Wallet → Deposit page, at about 6:49 PM CT (weareoxis[.]com) and about 7:00 PM CT (globaxio[.]com). During our capture, Cloudflare showed a "Suspected Phishing" interstitial on weareoxis[.]com before the wallet…
Other addresses in this report: bc1qqsh5ejt5n7u9fgxm6hcsgm9n6ymnl4z6az7qzj, 0x59f3cf4d3b42bde51a681855b9a8b97c01c297ce, TQhWvyxn2gcFzmhXSQXPFPqmn2WS9b4Taf, 0xac7d990d9f3b32ca3854c1975e6b5a73bb23670d, TLPveHNKWe3k5TWuQi7ja6yjXC7K2bo8pz, 0x0eda5a4200d3515bb51ea8d41a5ed0259ed69513, 0xe780238d53f710a26e92bf9b1d7902a5ac8819ac, ltc1qnw4ney4xs5errzp68zfjq0q3k0rh6ndgq5504e, XdgbwTMFXT3aLJBn8rwTy1Db3Tpt2LsanK, DH8Y27UDBUEUr8PUb4tE5VxTMQfpcCJG9x, F5etpWnpG5gZUrSn3YbdqwEUoB6qQq8vHUwhjJ1Xpugy, bc1q70yh6a306s7wvrmf5qua5hlk9h7nsva6fhgnq3, 0x32f1092882b43e9e9d79a326f683a6df22b2479c, 0x01a8ac4ad2e4928812588dc709b31ce0aed30647, TGXuStzK3VdM5uS5fqQv8VMgA5qV7edpKV, ltc1q5xsfsn82680hak6rgtp37lql4j6nz7ezch5jre, DQy3e2xnijQ5GhNYAhm71iZaYsRfp35ytR, 0xb40b750874a96252cdc26801e9ef1b7014c1c40c, Xb9SHZar5grkdv6X6rd8rrUkDNmXrMaR5C, EHuGhGHFWtHreKgvsLFotH1PoWTHyDFzizWAegWMpfB5 and 1 more
Websites in this report: weareoxis.com, globaxio.com
Linked reports: 49 live fake-exchange sites on an older kit generation linked to 2024 venanco[.]com and cryptovos[.]com: byte-identical JS, live sign-up (Oct 2026), Deposit wallets of 6 'calm-ui' kit fake exchanges incl. cryptovos[.]com, coinsco[.]io, hederabit[.]com: 131 addresses, shared TON backend (Oct 2026), XRP memo wallet rMrBAz…XoLD listed for 2024 fake exchanges weyshare[.]com, venanco[.]com, cbusy[.]com: 15.3M XRP in, same tag scheme as cryptovos