Is OxyCapitals a scam?

Yes, OxyCapitals (oxycapitalsltd.com) is a confirmed cryptocurrency scam that has stolen over $54,000. They impersonate legitimate Discord admins using typosquatting (changing one letter in usernames like "salmaogs" to "sajmaogs") to trick victims into depositing Bitcoin and other cryptocurrencies. We have documented blockchain evidence showing stolen funds being cashed out through exchanges.

Yes, MirrorExp (mirrorexp.com) is a confirmed cryptocurrency scam that has stolen over $30,000. They use typosquatting to impersonate Discord admins (changing ".atraveller" to "_atraveller") to direct victims to their fake trading platform. Funds are rapidly moved through staging wallets to exchanges within minutes of deposit.

What are the OxyCapitals scam wallet addresses?

Known OxyCapitals scam wallet addresses include: Bitcoin Collection (1NTXSjeydYLhWuXS8cVWx57VqyRFqz4gaC), Bitcoin Personal (1GC4fSsmgJMCtMh643WBCi5pBnTpqqCXP2), Bitcoin ByBit (192UAp4TEGApNdxPbSN5veQZ8ynyixjqvB), Bitcoin SegWit (bc1qz5xlayxpa3dk4u8vduwvx0r4f3v2sf0eejpd46), Ethereum (0x5f9ce0dA56c867D1BD06185D6d21744daC83cb09), and USDT Tron (TCgcYUD74LoeMoKRb7X6WcYPVD3VgZccZR). Do NOT send any cryptocurrency to these addresses.

What are the MirrorExp scam wallet addresses?

Known MirrorExp scam wallet addresses include: Bitcoin Primary (bc1qy28j32l0ntncyuqczzeau2k9yslh76djy0nh5v), Ethereum/USDC (0xE28425B27d555f870d3CaCAC4Bf7F549c768022F), and USDT (0xF4eE6d12f95f401BF6b0aB488Ec18E43bfdbeAFC). These wallets are part of a larger criminal operation with connections to a $2.1M exchange consolidation pool.

How does typosquatting work in crypto scams?

Typosquatting is when scammers create usernames nearly identical to trusted admins by changing just one character. Examples: "salmaogs" becomes "sajmaogs" (l→j), or ".atraveller" becomes "_atraveller" (period→underscore). These tiny changes are easy to miss at a glance, allowing scammers to impersonate trusted community members.

How do I report a cryptocurrency scam?

Report cryptocurrency scams to: 1) FBI IC3 at ic3.gov, 2) FTC at reportfraud.ftc.gov, 3) Chainabuse.com and BitcoinAbuse.com to flag wallet addresses, 4) The cryptocurrency exchanges (Binance, Coinbase, etc.) where scammers cash out, 5) Discord Trust & Safety for impersonation accounts, 6) Domain registrars like Namecheap to get scam websites taken down.

How can I identify crypto impersonation scams?

Red flags include: 1) Unsolicited DMs about investment opportunities, 2) Usernames with subtle differences from real admins (check character by character), 3) Pressure to act quickly, 4) Requests to use unfamiliar trading platforms, 5) Promises of guaranteed returns, 6) Requests to send crypto to "verify" your wallet. Always verify identities through official channels.

What should I do if I sent money to a crypto scam?

If you have been scammed: 1) Document everything - save messages, wallet addresses, transaction IDs, 2) Report to FBI IC3 and FTC immediately, 3) Report the wallet addresses to blockchain abuse databases, 4) Contact the exchange where funds were sent (they may be able to freeze accounts), 5) Report impersonation accounts to the platform (Discord, Telegram), 6) Share your experience to warn others.

How much money has been stolen by these crypto scams?

Based on blockchain analysis: OxyCapitals has stolen $40,400+ across Bitcoin, Ethereum, and Tron. MirrorExp has stolen $22,000+ primarily in Bitcoin. TruCopy has stolen $30,869+ across Bitcoin, Solana, and Ethereum. BridgeStocks stole $35,389 in Bitcoin before being taken down. Combined documented losses exceed $150,200 across 6 scam operations. Actual losses are likely higher as many victims do not report and some transactions may not be captured in our analysis.

Are OxyCapitals and MirrorExp related scams?

Both scams use identical methodology: Discord admin impersonation via typosquatting, fake trading platforms, rapid fund extraction to exchanges. While we cannot confirm they are run by the same operators, the operational patterns are strikingly similar, suggesting either the same group or shared scam playbooks within criminal networks.

Is AffluenceAura a scam?

Yes, AffluenceAura (affluenceaura.com) is a confirmed scam. It is a fake crypto investment platform with empty scam wallets on Bitcoin, Ethereum, and BNB. The site is not a registered business, uses WHOIS privacy, and shares the same V12Hosting infrastructure as the known EverrexTrade scam. No money has been deposited into its wallets, suggesting it was abandoned before gaining victims.

What are the AffluenceAura scam wallet addresses?

Known AffluenceAura scam wallets include: Bitcoin (bc1ql6w87cknrxf7qn5x5rhejw8tufche4rykgqmfx), Ethereum/BNB (0xB6C8EE0e6814d7016cF8afeA89942CDE382AC87a), and a possible Tezos address (TZB2iyLWCyiQXa7K8GAMs12XGR12FkqRzL). All wallets have zero transactions and zero balance as of February 2026.

Is AffluenceAura connected to other scams?

AffluenceAura shares the same V12Hosting nameservers (ns1.v12hosting.com, ns2.v12hosting.com) as the EverrexTrade scam, suggesting they may be operated by the same network or built from the same scam kit. Both are fake trading/investment platforms with hidden domain registration.

Scam AlertAbandoned

AffluenceAura is a SCAM

AffluenceAura.com is a fake cryptocurrency investment platform with scam wallet addresses on Bitcoin, Ethereum, and BNB. The site shares the same V12Hosting infrastructure as the EverrexTrade scam. No deposits were received — this scam appears to have been abandoned before gaining victims.

Fraudulent Investment Platform

affluenceaura.com

Total Money Stolen

$0.00 (abandoned)

Abandoned Scam — Zero Victims

All wallet addresses have zero transactions and zero balance

BTC Wallet

$0 / 0 txns

ETH Wallet

$0 / 0 txns

BNB Wallet

$0 / 0 txns

Tezos Wallet

$0 / 0 txns

This scam was discovered through URL pattern analysis before it could attract victims. We document it to blacklist the wallet addresses and connect it to the broader scam network.

Shared Infrastructure Detected

Same hosting provider as the EverrexTrade scam

EverrexTrade Nameservers

ns1.v12hosting.com

ns2.v12hosting.com

AffluenceAura Nameservers

ns1.v12hosting.com

ns2.v12hosting.com

Identical V12Hosting infrastructure — likely same operator or scam kit

Both scam sites use the exact same nameservers, suggesting they were created by the same operator or sourced from the same scam-as-a-service kit. See the EverrexTrade investigation for the connected scam.

Fake Platform Evidence

Screenshots of the fraudulent AffluenceAura website

Click any image to expand

AffluenceAura fake investment platform homepage showing crypto tickers and investment pitch

Fake Investment Homepage

"INVEST WITH CONFIDENCE. SECURE WITH INTELLIGENCE." — generic scam pitch with crypto ticker

WhatsApp Contact Number

+1 406-330-0697 (Montana area code) — embedded in the scam site

AffluenceAura fake deposit page accepting nonsense values like 696969LOL — clearly not a real financial platform

Fake Deposit Portal — Accepts Any Value

The deposit box accepts nonsense inputs like "696969LOL" — letters, words, anything. A real financial platform would validate numeric input. This proves the site is purely a front to steal deposits.

Platform Red Flags

✗Not a registered business — no company information anywhere

✗WHOIS fully redacted — registrant identity hidden

✗Same V12Hosting as confirmed EverrexTrade scam

✗Uses WhatsApp for "support" — no legitimate broker does this

✗No regulatory registration or compliance information

✗Generic template site with stock photos and buzzwords

✗Claims to be "POWERING THE ELITE ECONOMY" — meaningless slogan

✗Deposit portal accepts any value including letters and words (e.g. "696969LOL") — no real validation

✗All deposit wallets have zero activity — abandoned operation

Known Scam Wallet Addresses

All wallets verified as zero balance, zero transactions — blacklisted for future monitoring

Bitcoin (BTC)

bc1ql6w87cknrxf7qn5x5rhejw8tufche4rykgqmfx

Balance: 0 BTC ($0.00) | 0 transactions | Bech32 (P2WPKH)

Ethereum / BNB (shared address)

0xB6C8EE0e6814d7016cF8afeA89942CDE382AC87a

Balance: 0 ETH / 0 BNB ($0.00) | 0 transactions on both chains

Tezos (XTZ)

TZB2iyLWCyiQXa7K8GAMs12XGR12FkqRzL

Balance: Not found on Tezos explorer | Address format unverified

Good news: No victims lost money to this scam. All wallets have zero activity. These addresses are now documented to prevent future theft if the scam is revived.

WhatsApp Contact Evidence

The scam site embeds a WhatsApp contact button for "support"

Scam WhatsApp Number

Phone Number:

+1 406-330-0697

Area code 406 = Montana, United States

!No legitimate broker uses WhatsApp as their primary contact

!Likely a VoIP or burner number — easily disposable

!Can be reported to WhatsApp as fraudulent

WhatsApp link to AffluenceAura scam number +1 406-330-0697

Domain & WHOIS Analysis

Technical analysis of the affluenceaura.com domain

Domain Information

Domain:affluenceaura.com

Registered:April 5, 2025

Expires:April 5, 2026

Last Updated:Jan 26, 2026

Registrar:Cosmotown, Inc.

Registrant:Fully Redacted

Nameservers:ns1.v12hosting.com
ns2.v12hosting.com

DNSSEC:Unsigned

Domain Red Flags

✗WHOIS fully redacted — owner identity completely hidden

✗V12Hosting — same provider as EverrexTrade scam

✗Less than 1 year old — registered April 2025

✗Cosmotown registrar — less common registrar, harder to trace

Report This Domain

Registrar Abuse Contact:

abuse@cosmotown.com

Registrar Abuse Phone:

+1 650-319-8930

Official Fraud Report

This scam has been reported to Netcraft for takedown

Netcraft Report Submitted

Flagged for phishing & investment fraud

View Netcraft Report

Related Scam Operations

This scam uses identical methodology to other known operations

OxyCapitals

$54,000+ stolen

View Investigation

MirrorExp

$30,000+ stolen

View Investigation

TruCopy

$30,000+ stolen (8 chains)

View Investigation

BridgeStocks

$35,389 stolen (TAKEN DOWN)

View Investigation

EverrexTrade

Under Investigation

View Investigation

Pattern Match: These scams use Discord impersonation, fake trading platforms, and shared infrastructure. They may be operated by the same criminal network.

What To Do If You've Been Scammed

1. Report to Authorities

• FBI IC3: ic3.gov (Internet Crime Complaint Center)
• FTC: reportfraud.ftc.gov
• Local law enforcement

2. Report Wallet Addresses

• Chainabuse: chainabuse.com
• Bitcoin Abuse: bitcoinabuse.com
• Report to exchanges (Binance, Coinbase, Kraken, etc.)

3. Report the WhatsApp Number

Report the scam WhatsApp number +1 406-330-0697 directly in the WhatsApp app (open chat → tap contact info → Report). Also report to the registrar at abuse@cosmotown.com.

4. Report the Discord Account

Report the impersonator account to Discord Trust & Safety with screenshots of the conversation and the fake username.

5. Document Everything

Save all messages, transaction records, wallet addresses, and screenshots. This evidence is crucial for any investigation.

6. Warn Others

Share this page to help prevent others from falling victim to this scam.