Alert: Potential Crypto Swap Scam Network | jud-ex, darkmap, byware, nokyc-noaml

[Trêvoid]

Hello Bitcointalk community,

I'll get straight to the point. A few users on Bitcointalk and one of my clients were scammed by this individual. I conducted OSINT research and found several sites that share similarities with earlier scam sites (now offline)

Scam reports about jud-ex(.)com and darkmap(.)cc sites.

https://bitcointalk.org/index.php?topic=5576584.0
https://bitcointalk.org/index.php?topic=5570619.0
https://carigold.com/forum/threads/jud-ex-com-cryptocurrency-exchange-service.709663/post-27651833
https://www.okchanger.com/exchangers/Jud-ex-com



I believe there are similarities between those scam sites with byware(.)net and nokyc-noaml(.)cc




There may be additional sites like these. I believe the same Russian operator runs them and is targeting new victims. Please avoid using these services.

[albon]

If the domain is only 10 days old, how can they claim at the bottom “© 2015 - 2026 ByWare”? This is a clear contradiction.

Their site has not existed for 11 years as they claim, this is outright deception.  

byware(.)net | ARCHIVED

Registered On: 2026-03-13
Expires On: 2027-03-13
Updated On: 2026-03-15
Registrar: Tucows Domains Inc. IANA ID: 69
Age: 10 Days

I have looked at the both domains and indeed they use the same script with identical FAQ, ToS, and Affiliate Terms pages.. Also, There are no differences except for the logo and the domain name; the design and element layout are a 100% match.




nokyc-noaml(.)cc | ARCHIVED

Registered On: 2026-01-03
Expires On: 2027-01-03
Updated On: 2026-01-03
Registrar: Immaterialism Limited
Age: 2 Months 20 Days

Based on the source code of both websites, they share the exact same Tracker ID: 106889005. This confirms beyond any doubt that both sites are managed by the same person monitoring visitor traffic from a single dashboard and also, both platforms support the same languages (中文, हिन्दी, ES, PT, RU, FR, DE, UA) following the identical order and structural layout.

ByWare Yandex ID:

Code:

    <!-- Yandex.Metrika counter -->
    <script type="text/javascript">
        (function(m,e,t,r,i,k,a){
            m[i]=m[i]||function(){(m[i].a=m[i].a||[]).push(arguments)};
            m[i].l=1*new Date();
            for (var j = 0; j < document.scripts.length; j++) {if (document.scripts[j].src === r) { return; }}
            k=e.createElement(t),a=e.getElementsByTagName(t)[0],k.async=1,k.src=r,a.parentNode.insertBefore(k,a)
        })(window, document,'script','https://mc.yandex.ru/metrika/tag.js?id=106889005', 'ym');

        ym(106889005, 'init', {ssr:true, webvisor:true, clickmap:true, ecommerce:"dataLayer", referrer: document.referrer, url: location.href, accurateTrackBounce:true, trackLinks:true});
    </script>
    <noscript><div><img src="https://mc.yandex.ru/watch/106889005" style="position:absolute; left:-9999px;" alt="" /></div></noscript>
    <!-- /Yandex.Metrika counter -->

NoKYC-NoAML Yandex ID:

Code:

<!-- Yandex.Metrika counter -->
    <script type="text/javascript">
        (function(m,e,t,r,i,k,a){
            m[i]=m[i]||function(){(m[i].a=m[i].a||[]).push(arguments)};
            m[i].l=1*new Date();
            for (var j = 0; j < document.scripts.length; j++) {if (document.scripts[j].src === r) { return; }}
            k=e.createElement(t),a=e.getElementsByTagName(t)[0],k.async=1,k.src=r,a.parentNode.insertBefore(k,a)
        })(window, document,'script','https://mc.yandex.ru/metrika/tag.js?id=106889005', 'ym');

        ym(106889005, 'init', {ssr:true, webvisor:true, clickmap:true, ecommerce:"dataLayer", referrer: document.referrer, url: location.href, accurateTrackBounce:true, trackLinks:true});
    </script>
    <noscript><div><img src="https://mc.yandex.ru/watch/106889005" style="position:absolute; left:-9999px;" alt="" /></div></noscript>
    <!-- /Yandex.Metrika counter -->

There are no previous reviews for either site due to their recent registration. I strongly advise everyone to AVOID DEPOSIT ANY FUNDS TO THESE PLATFORMS.

Also, the representative’s account ^[ByWaRe] is a reactivated dormant account with a recent password reset, a common sign of a bought/hacked account used for scamming.

[NoKYC-NoAML.CC]

I believe there are similarities between those scam sites with byware(.)net and nokyc-noaml(.)cc

It is quite telling that you accused both us and ByWare of being a scam simply because we use the same website engine. I can see that you have been posting everywhere about how similar our websites look, but what exactly does that have to do with fraud?

People like you try to destroy others’ reputations with baseless assumptions, apparently to promote your own exchange service and get rid of competitors. We work honestly, and there have been no complaints against us.

[albon]

It is quite telling that you accused both us and ByWare of being a scam simply because we use the same website engine. I can see that you have been posting everywhere about how similar our websites look, but what exactly does that have to do with fraud?

People like you try to destroy others’ reputations with baseless assumptions, apparently to promote your own exchange service and get rid of competitors. We work honestly, and there have been no complaints against us.

Wow, your account was registered on February 13, 2026, and you haven't posted anything on the forum since then. Yet, you suddenly appear today right after the ByWaRe account was banned. Is that just a coincidence?



Also, you replied to OP but didn't address my discovery. The Yandex Metrika ID embedded in both websites is a personal account identifier; it is NOT a default part of any 'website engine' or script.

It’s also funny how you rushed to edit the source code on the ByWare site after seeing my post, but you forgot one thing: I have already archived your other website [HERE], so you can’t hide or modify anything now. The evidence is permanent.

[NoKYC-NoAML.CC]

It is quite telling that you accused both us and ByWare of being a scam simply because we use the same website engine. I can see that you have been posting everywhere about how similar our websites look, but what exactly does that have to do with fraud?

People like you try to destroy others’ reputations with baseless assumptions, apparently to promote your own exchange service and get rid of competitors. We work honestly, and there have been no complaints against us.

Wow, your account was registered on February 13, 2026, and you haven't posted anything on the forum since then. Yet, you suddenly appear today right after the ByWaRe account was banned. Is that just a coincidence?

Also, you replied to OP but didn't address my discovery. The Yandex Metrika ID embedded in both websites is a personal account identifier; it is NOT a default part of any 'website engine' or script.

It’s also funny how you rushed to edit the source code on the ByWare site after seeing my post, but you forgot one thing: I have already archived your other website [HERE], so you can’t hide or modify anything now. The evidence is permanent.

I don’t post anything on this forum because I’m currently based in Russia, but since this post touches on the reputation of my exchange platform, I naturally feel compelled to respond.

On top of that, we’re also acquainted with Byware, and they brought this post to my attention; in fact, we got to know them precisely because of the sale of this engine.

Does the fact that Yandex Metrics is still there mean that some kind of scam took place? Or what does that prove?

You are making serious accusations against us, but you’re backing them up with unclear evidence. Please provide proof of our dishonest actions!

You’ve spread unfounded rumors everywhere, but in reality, you’re only pointing out that our websites look similar—and that doesn’t prove anything at all!

[albon]

Nice try, but your explanation only makes it worse.

I don’t post anything on this forum because I’m currently based in Russia, but since this post touches on the reputation of my exchange platform, I naturally feel compelled to respond.

On top of that, we’re also acquainted with Byware, and they brought this post to my attention; in fact, we got to know them precisely because of the sale of this engine.

What’s the problem with being based in Russia? There are many Russian members here on the forum. You admitted that ByWaRe (a banned user) contacted you to respond here; in the eyes of the forum rules, this is clear ban evasion via a alt account. Your timing is too convenient to be a coincidence.

we got to know them precisely because of the sale of this engine.

Does the fact that Yandex Metrics is still there mean that some kind of scam took place? Or what does that prove?

A Yandex Metrika ID it is a personal tracking account. Having the same ID [106889005] on both websites indicates they are managed from the same control panel. No developer would sell an engine with their personal tracking ID unless he is the actual person running both sites.

You are making serious accusations against us, but you’re backing them up with unclear evidence. Please provide proof of our dishonest actions!

Why did you rush to delete it from the source code the moment I exposed it? You are clearly trying to hide what incriminates you, but you won't be able to escape the facts.

[logfiles]

The good news is that the ByWaRe profile has been banned which means any other linked profile should be banned since they are evading the ban. For now let's create flags for both profiles to protect newbies and guest users

ByWare(.)net were so quick to list themselves on platforms such as https://bitmixlist.org and https://bitlist.co. I don't know if the listings can just be done by anybody or must first get approved

They should be probably be deleted
1. https://bitlist.co/service/bywarenet
2. https://bitmixlist.org/#neverkyc-exchanges

[NoKYC-NoAML.CC]

Nice try, but your explanation only makes it worse.

I don't know whose situation this is making worse, but you're just talking nonsense—making baseless accusations and simply pointing out similarities between our site and Byware, claiming they're identical. But I don't deny it, and Byware doesn't deny it either—we do use the same engine. However, that doesn't mean we're scammers.

What’s the problem with being based in Russia? There are many Russian members here on the forum. You admitted that ByWaRe (a banned user) contacted you to respond here; in the eyes of the forum rules, this is clear ban evasion via a alt account. Your timing is too convenient to be a coincidence.

You’re quite the fantasist—I’ve already noticed that. You’re trying to latch onto something, but you don’t know what else to come up with to discredit us. I created an account here right after launching my exchange; the fact that I haven’t created a thread here yet is my own business—it’s up to me where to post it and where not to.

A Yandex Metrika ID it is a personal tracking account. Having the same ID [106889005] on both websites indicates they are managed from the same control panel. No developer would sell an engine with their personal tracking ID unless he is the actual person running both sites.

You are pretending this is some kind of “smoking gun,” but all it really shows is that you do not understand what a Yandex Metrica ID actually proves. The same Metrica counter can be used on multiple websites, so matching IDs alone prove nothing about common ownership, control, or fraud.

In our case, that field is simply a default placeholder in the engine template, intended to be replaced by whoever wants to connect their own Yandex Metrica account. More importantly, neither our exchange nor ByWare has been shown to be involved in any fraudulent activity.

And what makes your argument even weaker is that you are not proving any link to fraud at all — only trying to point to some connection with ByWare, which we have never denied. But that proves absolutely nothing.

Why did you rush to delete it from the source code the moment I exposed it? You are clearly trying to hide what incriminates you, but you won't be able to escape the facts.

I've already noticed that you often make up facts that don't exist; I didn't delete anything

[rat03gopoh]

I don't know whose situation this is making worse, but you're just talking nonsense—making baseless accusations and simply pointing out similarities between our site and Byware, claiming they're identical. But I don't deny it, and Byware doesn't deny it either—we do use the same engine. However, that doesn't mean we're scammers.

That's a valid suspicion; scammers have been caught doing the same thing for years: cheap templates and a one-time license fee. If one domain is terminated, there's no need to wait for further evidence for the next ones. Don't pretend you don't know how it works.

[logfiles]

There may be additional sites like these. I believe the same Russian operator runs them and is targeting new victims. Please avoid using these services.

I am not saying the service maybe linked to the ones above, but I did notice some striking similarities with this one as well, and it was also announced recently in the currency board
- exmymoney.com

The did use a different colour theme but most of it is the same as the other two. I hope it's just a coincidence.

[NoKYC-NoAML.CC]

That's a valid suspicion; scammers have been caught doing the same thing for years: cheap templates and a one-time license fee. If one domain is terminated, there's no need to wait for further evidence for the next ones. Don't pretend you don't know how it works.

The fact is, the only thing that has been proven in this thread is that we use the same engine as the byware website, but we don’t deny that, and there’s nothing illegal about it.

Please also note that neither we nor Byware are involved in any fraudulent activities. As for the fact that other sites have been blocked, we have absolutely no connection to them, and this topic does not discuss any connection to them at all; no evidence is provided, just an assumption.

You cannot make such accusations of fraud based on the fact that several websites use the same engine, especially when none of them are engaging in any fraudulent activities!

[Trêvoid]

There may be additional sites like these. I believe the same Russian operator runs them and is targeting new victims. Please avoid using these services.

I am not saying the service maybe linked to the ones above, but I did notice some striking similarities with this one as well, and it was also announced recently in the currency board
- exmymoney.com

The did use a different colour theme but most of it is the same as the other two. I hope it's just a coincidence.

The website has been stopped

Sorry, This site has been stopped by the administrator，Please contact the administrator for details.

apparently to promote your own exchange service and get rid of competitors. We work honestly, and there have been no complaints against us.

trust me i have a very good legit client base that i don't even do ads,i just bump my thread and hunt down scammers.

[albon]

The website has been stopped

Sorry, This site has been stopped by the administrator，Please contact the administrator for details.

Update: The Scam Site is now DOWN.

Nokyc-noaml.cc is DOWN for everyone. | SOURCE

As expected, right after being exposed with undeniable technical evidence, nokyc-noaml(.)cc has gone offline. The domain no longer resolves to any IP address.

This is the classic behavior of a caught scammer as he try to deny the facts with AI-generated excuses and attempt to scrub the Yandex ID code. When caught red-handed via archives (Wayback Machine), shut down the site and disappear.

To the moderators and the community: This is a confirmed Exit Scam / Fraudulent Network. I am requesting a permanent ban for this account > [@NoKYC-NoAML.CC] to prevent further victims.

[NoKYC-NoAML.CC]

trust me i have a very good legit client base that i don't even do ads,i just bump my thread and hunt down scammers.

Your signature suggests otherwise: when you start posting in other exchange platforms’ threads, accusing them of fraud without any concrete evidence, you undermine their reputation; yet in your signature and avatar, you imply that your own business practices are more trustworthy than those of the people you’re slandering.

The website has been stopped

Sorry, This site has been stopped by the administrator，Please contact the administrator for details.

Update: The Scam Site is now DOWN.

Nokyc-noaml.cc is DOWN for everyone. | SOURCE

As expected, right after being exposed with undeniable technical evidence, nokyc-noaml(.)cc has gone offline. The domain no longer resolves to any IP address.

This is the classic behavior of a caught scammer as he try to deny the facts with AI-generated excuses and attempt to scrub the Yandex ID code. When caught red-handed via archives (Wayback Machine), shut down the site and disappear.

To the moderators and the community: This is a confirmed Exit Scam / Fraudulent Network. I am requesting a permanent ban for this account > [@NoKYC-NoAML.CC] to prevent further victims.

I apologize for being blunt, but you’re a fantasist!

1) Our website was accessible and remains accessible. I already realized you were prone to fantasizing when you claimed that I had deleted the Yandex Metrics ID, even though I never touched it or deleted it—it’s still there.

2) There is not a single piece of evidence in this thread that we are in any way connected to fraud. You simply claim that our website and Byware are identical, but we don’t deny that—we use the same engine, and there is nothing fraudulent about that!

3) Neither our service nor Byware, which use the same engine, have ever engaged in any fraudulent activity. You’ve only mentioned a few other sites that have absolutely nothing to do with us; you’re simply stirring up baseless intrigue against us here without providing any evidence.

3) I am not breaking the forum rules and am behaving honestly—why should I be banned?


Why are you trying so hard to block my account, just so I can’t speak the truth here and refute all your wild claims?

I’m not promoting anything on this forum; I’m only participating in this thread to provide reasoned responses to all the nonsense you’re spouting here!

[albon]

I apologize for being blunt, but you’re a fantasist!

I don't need to fantasize because I have Wayback Machine archives. The code was there then you tried to scrub it and then you shut down the site. Everyone knows that this is clear behavior of a caught scammer.

1) Our website was accessible and remains accessible. I already realized you were prone to fantasizing when you claimed that I had deleted the Yandex Metrics ID, even though I never touched it or deleted it—it’s still there.

Anyone can check your site right now, they will find "DNS_PROBE_FINISHED_NXDOMAIN." The server IP address cannot be found because you pulled the DNS immediately after being exposed.

2) There is not a single piece of evidence in this thread that we are in any way connected to fraud. You simply claim that our website and Byware are identical, but we don’t deny that—we use the same engine, and there is nothing fraudulent about that!

A Yandex Metrika ID [106889005] It is not part of a shared engine because sharing this ID across many domains indicates they are managed by the same owner behind them.

The evidence is the Wayback Machine archives which captured the ID before you attempted to scrub it and your panic shutdown of the domain is the admission of guilt.

[NoKYC-NoAML.CC]

I don't need to fantasize because I have Wayback Machine archives. The code was there then you tried to scrub it and then you shut down the site. Everyone knows that this is clear behavior of a caught scammer.

You're a liar! You're lying—show me the log where it clearly shows that I deleted my Yandex ID from my website. I didn't do that. I don't know what your motive is, but your lies will ruin your own reputation. Since you claim to have the logs, post them here for everyone to see! I know you don’t have them, because I didn’t change my Yandex ID! Anyone can see for themselves that you're a blabbermouth by visiting web.archive and checking the entire Wayback Machine archive you're talking about

Anyone can check your site right now, they will find "DNS_PROBE_FINISHED_NXDOMAIN." The server IP address cannot be found because you pulled the DNS immediately after being exposed.

What you posted still isn’t proof of fraud. After your repeated accusations and, apparently, complaints, our domain has been blocked for users in several countries – that’s a third‑party action, not a “panic shutdown.” We never “pulled the DNS”; the site is still live and can be reached via networks that aren’t subject to the block (for example through Tor). When a country’s DNS servers block a domain, all you get is a DNS_PROBE_FINISHED_NXDOMAIN error.

That’s why the link you to quote from
https://downforeveryoneorjustme.com/nokyc-noaml.cc
 always reports us as down: it uses the same public resolvers that are blocking the domain, so it simply repeats the block. This doesn’t prove anything about fraud; it just shows you don’t understand how those services work.

If the site is blocked or not resolving in your region, that is your local network issue, not proof of fraud. You are taking a technical symptom you clearly do not understand and trying to turn it into a public accusation. That is not evidence, not investigation, and not credibility — it is just ignorance dressed up as drama.

A Yandex Metrika ID [106889005] It is not part of a shared engine because sharing this ID across many domains indicates they are managed by the same owner behind them.

On how many other domains? Only on mine and on Byware. I’ve already said many times that neither I nor Byware deny that we had the same Yandex ID listed or that we use the same engine. But I’ll say it again: we have absolutely no connection to any of the other sites mentioned in the first post!

I already mentioned the Yandex ID above, but since you’re making me repeat myself, I’ll say this: This ID is set by default in the engine’s database, and I haven’t changed it—and besides, I don’t even use a Yandex account! But since you’re so fixated on the fact that Byware and we had the same Yandex ID, what does that prove? Absolutely nothing—and how does that relate to our involvement in fraud or to the websites mentioned above? Huh?

And what makes your argument even weaker is that you are not proving any link to fraud at all — only trying to point to some connection with ByWare, which we have never denied. But that proves absolutely nothing. A connection to ByWare is not proof of fraudulent activity, and repeating it over and over does not magically turn it into evidence.

So once again, this is not evidence — it is just your own technical ignorance dressed up as an investigation.