Is OxyCapitals a scam?

Yes, OxyCapitals (oxycapitalsltd.com) is a confirmed cryptocurrency scam that has stolen over $54,000. They impersonate legitimate Discord admins using typosquatting (changing one letter in usernames like "salmaogs" to "sajmaogs") to trick victims into depositing Bitcoin and other cryptocurrencies. We have documented blockchain evidence showing stolen funds being cashed out through exchanges.

Yes, MirrorExp (mirrorexp.com) is a confirmed cryptocurrency scam that has stolen over $30,000. They use typosquatting to impersonate Discord admins (changing ".atraveller" to "_atraveller") to direct victims to their fake trading platform. Funds are rapidly moved through staging wallets to exchanges within minutes of deposit.

What are the OxyCapitals scam wallet addresses?

Known OxyCapitals scam wallet addresses include: Bitcoin Collection (1NTXSjeydYLhWuXS8cVWx57VqyRFqz4gaC), Bitcoin Personal (1GC4fSsmgJMCtMh643WBCi5pBnTpqqCXP2), Bitcoin ByBit (192UAp4TEGApNdxPbSN5veQZ8ynyixjqvB), Bitcoin SegWit (bc1qz5xlayxpa3dk4u8vduwvx0r4f3v2sf0eejpd46), Ethereum (0x5f9ce0dA56c867D1BD06185D6d21744daC83cb09), and USDT Tron (TCgcYUD74LoeMoKRb7X6WcYPVD3VgZccZR). Do NOT send any cryptocurrency to these addresses.

What are the MirrorExp scam wallet addresses?

Known MirrorExp scam wallet addresses include: Bitcoin Primary (bc1qy28j32l0ntncyuqczzeau2k9yslh76djy0nh5v), Ethereum/USDC (0xE28425B27d555f870d3CaCAC4Bf7F549c768022F), and USDT (0xF4eE6d12f95f401BF6b0aB488Ec18E43bfdbeAFC). These wallets are part of a larger criminal operation with connections to a $2.1M exchange consolidation pool.

How does typosquatting work in crypto scams?

Typosquatting is when scammers create usernames nearly identical to trusted admins by changing just one character. Examples: "salmaogs" becomes "sajmaogs" (l→j), or ".atraveller" becomes "_atraveller" (period→underscore). These tiny changes are easy to miss at a glance, allowing scammers to impersonate trusted community members.

How do I report a cryptocurrency scam?

Report cryptocurrency scams to: 1) FBI IC3 at ic3.gov, 2) FTC at reportfraud.ftc.gov, 3) Chainabuse.com and BitcoinAbuse.com to flag wallet addresses, 4) The cryptocurrency exchanges (Binance, Coinbase, etc.) where scammers cash out, 5) Discord Trust & Safety for impersonation accounts, 6) Domain registrars like Namecheap to get scam websites taken down.

How can I identify crypto impersonation scams?

Red flags include: 1) Unsolicited DMs about investment opportunities, 2) Usernames with subtle differences from real admins (check character by character), 3) Pressure to act quickly, 4) Requests to use unfamiliar trading platforms, 5) Promises of guaranteed returns, 6) Requests to send crypto to "verify" your wallet. Always verify identities through official channels.

What should I do if I sent money to a crypto scam?

If you have been scammed: 1) Document everything - save messages, wallet addresses, transaction IDs, 2) Report to FBI IC3 and FTC immediately, 3) Report the wallet addresses to blockchain abuse databases, 4) Contact the exchange where funds were sent (they may be able to freeze accounts), 5) Report impersonation accounts to the platform (Discord, Telegram), 6) Share your experience to warn others.

How much money has been stolen by these crypto scams?

Based on blockchain analysis: OxyCapitals has stolen $40,400+ across Bitcoin, Ethereum, and Tron. MirrorExp has stolen $22,000+ primarily in Bitcoin. TruCopy has stolen $30,869+ across Bitcoin, Solana, and Ethereum. BridgeStocks stole $35,389 in Bitcoin before being taken down. Combined documented losses exceed $150,200 across 6 scam operations. Actual losses are likely higher as many victims do not report and some transactions may not be captured in our analysis.

Are OxyCapitals and MirrorExp related scams?

Both scams use identical methodology: Discord admin impersonation via typosquatting, fake trading platforms, rapid fund extraction to exchanges. While we cannot confirm they are run by the same operators, the operational patterns are strikingly similar, suggesting either the same group or shared scam playbooks within criminal networks.

Is EverrexTrade a scam?

Yes, EverrexTrade (everrextrade.com) is a confirmed scam. The site is a fake forex/stocks trading platform promoted through Discord impersonation. The scammer uses the username salmaogs_pm to impersonate a real community admin. The website contains Latin placeholder text (lorem ipsum), hidden WHOIS registration, and uses the exact same impersonation tactics as other known scam operations like OxyCapitals, MirrorExp, and TruCopy.

How does the EverrexTrade scam work?

The scammer creates a fake Discord account (salmaogs_pm) that impersonates a real community admin (salmaogs). They DM potential victims asking about their "trading progress" and direct them to register on everrextrade.com, described as an "expert mirror trading broker." The site is a fraudulent platform designed to steal deposits.

Who is behind the EverrexTrade scam?

The domain everrextrade.com is registered through GoDaddy with WHOIS privacy (Domains By Proxy, LLC). The scammer operates under the Discord username salmaogs_pm, impersonating the same real admin (salmaogs) targeted by multiple other scam operations. This suggests a coordinated criminal network.

Scam Alert - Active Investigation

EverrexTrade is a SCAM

EverrexTrade.com is a fake forex/stocks trading platform promoted through Discord impersonation using typosquatting. The scammer impersonates a real community admin to lure victims into depositing money on a fraudulent website filled with Latin placeholder text.

Fraudulent Trading Platform

everrextrade.com

Investigation In Progress

Blockchain analysis pending - cryptocurrency addresses not yet captured

Platform Evidence

Documented

Discord Impersonation

Confirmed

Domain Analysis

Complete

Crypto Addresses

Pending

This page will be updated as crypto wallet addresses and blockchain transaction data are obtained and analyzed.

Typosquatting Attack Detected

The scammer added "_pm" to a real admin's username

Can you spot the difference?

REAL ADMIN USERNAME

salmaogs

SCAMMER USERNAME

salmaogs_pm

The scammer added the suffix _pm: salmaogs became salmaogs_pm

Same target, different scam: This is the same real admin (salmaogs) also impersonated by the TruCopy scam as _salma_ogs and the OxyCapitals scam as sajmaogs.

How This Scam Works

Impersonation

Scammer creates Discord account salmaogs_pm mimicking a real admin.

Social Engineering

DMs victims asking about their "trading progress" to build false trust.

Fake Platform

Directs to everrextrade.com — a template scam site with Latin lorem ipsum text.

Theft

Victims deposit crypto/money which is immediately stolen by the scammer.

Fake Platform Evidence

Screenshots of the fraudulent EverrexTrade website

Click any image to expand

EverrexTrade fake trading platform homepage showing stock tickers and account types

Fake Trading Homepage

Stock tickers, "Complete Stocks Trading Experience" — designed to look like a real broker

EverrexTrade about page with Latin lorem ipsum placeholder text exposing it as a template scam

Latin Placeholder Text (Dead Giveaway)

"Optio cumque nihil impedit quo minus..." — lorem ipsum proves this is a scam template

Scam Template Evidence: Latin Lorem Ipsum

Text found on the EverrexTrade "About" page:

"Optio cumque nihil impedit quo minus id quod maxime place at facere possimus, omnis voluptas assumenda omnis dolors repellendus tempori bus autem quibusdam dolorem eum fugiat quo voluptas."

This is Latin lorem ipsum placeholder text left by the scam template developers. No legitimate trading platform would have untranslated Latin filler text on their website. This proves the site was built from a pre-made scam kit without even bothering to replace the placeholder content.

Platform Red Flags

✗Latin lorem ipsum placeholder text on the About page

✗Claims to be operating "Since 2012" — domain registered 2018

✗WHOIS hidden behind Domains By Proxy (GoDaddy)

✗Promoted exclusively via Discord impersonation DMs

✗No regulatory registration or compliance information

✗Generic stock template site with fake ticker data

Discord Impersonation Evidence

Side-by-side comparison of the fake scammer account vs the real admin

Fake Scammer Account

Fake Discord account salmaogs_pm impersonating real admin Salma

Username:salmaogs_pm

Member Since:Feb 12, 2025

Mutual Servers:0 (No Mutual Servers)

Roles:None

Connections:None

Activity:None

Real Admin Account

Username:salmaogs

Member Since:Jun 12, 2020

Mutual Servers:1 Mutual Server

Roles:FOUNDER — CEO + 4 more

Connections:X (3,459 Posts)

Bio Note:"ONLY ACCOUNT"

How to Spot the Fake

• Username suffix: Fake adds _pm (salmaogs_pm) vs real (salmaogs)
• Account age: Fake created Feb 2025 (5 years newer than real account from 2020)
• No mutual servers: Scammer account has zero connection to the actual community
• No roles: Real admin has FOUNDER — CEO, flow analyst, flow master, Server Booster roles; scammer has none
• No connections: Real admin has a verified X/Twitter account with 3,459 posts; scammer has nothing
• Copied bio: Scammer duplicated the real admin's bio but uses a different Linktree link (linktr.ee/OnlyGainsSociety vs real linktr.ee/salmaogs)
• Real account warns: States "ONLY ACCOUNT / DMS ALWAYS OPEN" indicating awareness of impersonators

Scammer Conversation Evidence

Actual messages from the scammer directing victims to EverrexTrade

Click image to expand

Discord conversation with EverrexTrade scammer salmaogs_pm directing victim to fake trading platform

Full Scam Conversation

Scammer builds rapport then directs to everrextrade.com

Conversation Timeline

SCAMMERFeb 4, 2026 — 9:49 AM

"Hello @Kev how are you doing today, and how's your trading progress been lately?"

Initial contact — friendly opener to build rapport

SCAMMERFeb 5, 2026 — 6:24 AM

"I believe you're following up with the calls and puts on the server. Do you have any questions or concerns about our trading algorithm?"

Follow-up — references server activity to seem legitimate

VICTIMFeb 5, 2026 — 9:17 AM

"whats the site of the algorithm"

SCAMMERFeb 5, 2026 — 9:54 AM

"In order to join live sessions, learn from my experience and grow your trading account simultaneously, log on to the expert mirror trading broker and register an account https://everrextrade.com/. When you're done with that, let me know so I can guide you through."

THE TRAP — directs victim to the scam platform

Warning: The scammer uses professional language and references "live sessions," "mirror trading," and "expert brokers" to sound legitimate. No real admin would DM you unsolicited investment opportunities.

Domain & WHOIS Analysis

Technical analysis of the everrextrade.com domain

WHOIS record for everrextrade.com showing GoDaddy registration and privacy proxy

WHOIS Lookup

Domain registration hidden behind privacy proxy

Domain Information

Domain:everrextrade.com

Registered:March 13, 2018

Expires:March 13, 2026

Last Updated:July 24, 2025

Registrar:GoDaddy.com, LLC

Privacy:Domains By Proxy, LLC

Nameservers:ns1.v12hosting.com
ns2.v12hosting.com

DNSSEC:Unsigned

Domain Red Flags

✗WHOIS hidden — legitimate brokers proudly display company registration

✗Claims "Since 2012" — but domain registered in 2018

✗Privacy proxy — Domains By Proxy used to hide operator identity

✗Budget hosting — V12Hosting, not enterprise-grade infrastructure

Report This Domain

Registrar Abuse Contact:

abuse@godaddy.com

Registrar Abuse Phone:

480-624-2505

Connected Scam Network

The same real admin (salmaogs) has been impersonated by at least 4 different scam operations

Impersonation Pattern Map

REAL ADMIN

salmaogs

Discord account since June 2020

↓ Impersonated by ↓

OXYCAPITALS SCAM

sajmaogs

Changed l→j

MIRROREXP SCAM

_atraveller

Different admin impersonated

TRUCOPY SCAM

_salma_ogs

Added underscores

EVERREXTRADE SCAM

salmaogs_pm

Added _pm suffix

Criminal Network Pattern: Multiple scam operations targeting the same community admin suggests either a coordinated criminal network or widely shared scam playbooks. Each operation uses a different fake trading platform but identical impersonation methodology.

Blockchain Analysis

Cryptocurrency wallet and transaction analysis

Pending Investigation

Cryptocurrency deposit addresses from the EverrexTrade platform have not yet been captured. Once obtained, full blockchain transaction tracing and money flow analysis will be published here.

Wallet Addresses: Not Yet Captured

Transaction Analysis: Pending

Related Scam Operations

This scam uses identical methodology to other known operations

OxyCapitals

$54,000+ stolen

View Investigation

MirrorExp

$30,000+ stolen

View Investigation

TruCopy

$30,000+ stolen (8 chains)

View Investigation

BridgeStocks

$35,389 stolen (TAKEN DOWN)

View Investigation

AffluenceAura

$0 stolen (abandoned)

View Investigation

Pattern Match: These scams use Discord impersonation, fake trading platforms, and shared infrastructure. They may be operated by the same criminal network.

What To Do If You've Been Scammed

1. Report to Authorities

• FBI IC3: ic3.gov (Internet Crime Complaint Center)
• FTC: reportfraud.ftc.gov
• Local law enforcement

2. Report Wallet Addresses

• Chainabuse: chainabuse.com
• Bitcoin Abuse: bitcoinabuse.com
• Report to exchanges (Binance, Coinbase, Kraken, etc.)

3. Report to Domain Registrar

Report everrextrade.com to GoDaddy's abuse team at abuse@godaddy.com or call 480-624-2505. Request an investigation into the domain for promoting investment fraud.

4. Report the Discord Account

Report the impersonator account to Discord Trust & Safety with screenshots of the conversation and the fake username.

5. Document Everything

Save all messages, transaction records, wallet addresses, and screenshots. This evidence is crucial for any investigation.

6. Warn Others

Share this page to help prevent others from falling victim to this scam.