Suspicious Refund Claim & Malicious Domain Promoted by akmal1984

[albon]

What happened:: This user posted their first thread regarding Criptointercambio, claiming that they were scammed out of $320,000 USDC in [this thread]. Later, He created another thread claiming that this company scammed them out of 2.1 BTC in [this thread].

After some time, he edited his first topic and added the following at the bottom of it:

[UPDATE]: I got refunded yesterday after 10 months of being funds held!!! Attached screenshot: https://i.ibb.co/v6r4h6L7/2026-01-06-06-10-20.jpg

For anyone in the same situation, here’s what to do: send a ticket request to their support criptointercambio[.]support/ clearly state that you will involve a lawyer if they do not release your funds. Shortly after I did this, they refunded me. Their service is completely unregulated and appears to be operating illegally in many countries.

As you can see, he claimed they refunded him and included a suspicious link not belonging to the company's official support, along with a screenshot without including the transaction hash. Also, if we check the address shown in the screenshot, I could not find the transaction that occurred: https://tronscan.org/#/address/TYuQxCgRFkYQDHLrWNJK2qwCgdMBJgRkT1/transfers

Scammers Profile Link: https://bitcointalk.org/index.php?action=profile;u=919324  | FLAG

Reference Link:

[1] https://bitcointalk.org/index.php?topic=5569062.0
[2] https://bitcointalk.org/index.php?topic=5570360.0
[3] criptointercambio[.]support

Domain Name: CRIPTOINTERCAMBIO.SUPPORT
Registrar:   Pdr Ltd. D/b/a Publicdomainregistry.com IANA ID 303
Status:clientTransferProhibited
Registrant Organization: Mateo Campbell
Registrant Email: campbell91@mailgrock.xyz
Creation Date: December 23, 2025 (2 weeks ago)
Update Date: January 7, 2026 (9 hours ago)
Expiration Date:   December 23, 2026
Age:   15 days
Source: https://www.domainiq.com/domain?criptointercambio.support#/whois

Additional Notes:
The domain he promoted has only been active for 15 days, and what this user did was a malicious attempt to trick people to make people believe they should contact customer support through the suspicious domain he promoted, hoping to recover their funds. This would not, as they are likely to fall victim to another scam.

Also, this member's account has already been tagged. Take a look at the following:

suchmoon

2019-12-24

Promotes Yobit's "10% daily" scam.

actmyname

2021-01-17

Reference

Part of the Spammer Blacklist: this user has made at least 50 replies that are not up to forum standards. This user is part the top 1000 worst spammers of all time.

The official customer support email for this company is: support@criptointercambio.com

[JeromeTash]

Not that the previous owner might have not been shady, but it seems the account has been hijacked by someone with intentions of straight-up fraud.
A recent email and password change is yet another red flag



For this case, I am going to tag and support the flag against the account. Thanks, @albon. We almost got fooled by the move.

[albon]

Not that the previous owner might have not been shady, but it seems the account has been hijacked by someone with intentions of straight-up fraud.
A recent email and password change is yet another red flag



For this case, I am going to tag and support the flag against the account. Thanks, @albon. We almost got fooled by the move.

You're welcome!

I agree with you; this may indeed have happened. I reported his first thread, which he edited and included the suspicious link, and I hope it will be reviewed by the moderators and then deleted.

In addition, I will submit a report to the domain registrar of this site, Publicdomainregistry, so that they can completely shut down this website, and I hope you will do the same.

I hope this serves as a lesson to many so they don't fall for any stories being spread here, and that they always do their research and deal only with official links and official company contact emails, rather than others.

[Zwei]

nice catch @albon, looks like the scammers got a new trick to post phishing links. flag supported.

Not that the previous owner might have not been shady, but it seems the account has been hijacked by someone with intentions of straight-up fraud.
A recent email and password change is yet another red flag

he is also shilling for an exchange that is probably a scam called darkchange[.]io, another account is also doing the same ihavenoidea24

The smoothest/fastest way to buy Monero/even Zcash is using an instant exchange:

My favourite one is: https[:]//darkchange[.]io/ that's always smooth, big liquidity and never asks for kyc.

if you check the domain, it was only registered around 6 weeks ago.



and i also found a bunch of accounts on reddit shilling for it, so add that to the list of red flags.

https://www.reddit.com/r/cryptocrime/comments/1pwcbtn/drained_for_850k_hacker_cashed_out_to_monero/
https://www.reddit.com/r/SwapCryptoNoKYC/comments/1pmef3r/darkchange_simple_crypto_swaps_without_kyc/
https://www.reddit.com/r/OCryptoCanada/comments/1pvbrwp/convert_cad_to_crypto_without_leaving_tracks/
https://www.reddit.com/r/defi/comments/1q0b4z6/darkchangeio_anyone_using_it/

[The Cryptovator]

What happened:: This user posted their first thread regarding Criptointercambio, claiming that they were scammed out of $320,000 USDC in [this thread]. Later, He created another thread claiming that this company scammed them out of 2.1 BTC in [this thread].

After some time, he edited his first topic and added the following at the bottom of it:

Nonsense. Anyone stupid would believe his story; I am not. Am I the only one who thinks the account changed hands? It's just not about changing the email password recently. It's also about the cheating and scamming practice of the account. I have remembered how Yobit advertised their scam schemes. They even accepted red tag users, which means all spammers joined together. There were a lot of bought accounts that changed hands, though we don't have evidence, but I realised. So this account used to promote Yobit, which was a scam. Now probably the account changed hands again, and now he wants to scam through some very poor script.

Everything is clear here; his intention was to scam people and promote something to draw attention from the forum. People might be interested in that site for give an try, because they might believe that if something went wrong, that site would refund the money. Hence, I leave negative feedback along with an account-changed-hand caution. Supported the flag as well.

[hugeblack]

nice catch

I thought he got his money back, but it turned out to be another scam attempt. Thank you, I will edit my post.

[noorman0]

-snip-
he is also shilling for an exchange that is probably a scam called darkchange[.]io, another account is also doing the same ihavenoidea24

It seems like something's missing, check out this user: FeraLc

I think this is still run by the same person because they've been posting a lot in the same thread lately, asking each other bait questions. Previously, he shilled several fake sites:
- coinflip(s).io (he edited the post after being caught)
- darkchange.(io) (asserts that this service is legit).

[albon]

Everything is clear here; his intention was to scam people and promote something to draw attention from the forum. People might be interested in that site for give an try, because they might believe that if something went wrong, that site would refund the money.

People will not be able to try the site because I reported it yesterday, and I received the following message from PublicDomainRegistry:  

Hello Team,

Thank you for bringing this to our notice. The reported domain name has been suspended and this will be reflected within 4–6 hours.

Please feel free to contact us again.

Regards,
Abuse Mitigation Team
PublicDomainRegistry

I truly appreciate what this domain registrar does in terms of fast response to reports submitted to them. This was not the only domain promoted by this scammer that was taken down; rather, many of these domains were registered through PublicDomainRegistry. When a report is submitted with sufficient evidence attached, they take action after their team reviews the report, usually within 48 hours.

nice catch

I thought he got his money back, but it turned out to be another scam attempt. Thank you, I will edit my post.

You're welcome. Glad it helped.  

Unfortunately, scammers use every kind of trick. You can imagine that he posts fake stories just to attract the community’s attention and generate enough engagement and replies. After that, he makes a deceptive update so victims may believe he is actually honest. He might even come back with new accounts, so we must stay vigilant. Thanks for your input.

I think this is still run by the same person because they've been posting a lot in the same thread lately, asking each other bait questions. Previously, he shilled several fake sites:
- coinflip(s).io (he edited the post after being caught)
- darkchange.(io) (asserts that this service is legit).

This might be his other alternate account, as @FeraLc did the same thing as @akmal1984. I will tag his account now, since it clearly appears that he posted a phishing link instead of the original platform link, and after members exposed him, he reverted it back to the original platform link.

Well done, man.