Alert: Potential Crypto Swap Scam Network | jud-ex, darkmap, byware, nokyc-noaml

[Trêvoid]

Hello Bitcointalk community,

I'll get straight to the point. A few users on Bitcointalk and one of my clients were scammed by this individual. I conducted OSINT research and found several sites that share similarities with earlier scam sites (now offline)

Scam reports about jud-ex(.)com and darkmap(.)cc sites.

https://bitcointalk.org/index.php?topic=5576584.0
https://bitcointalk.org/index.php?topic=5570619.0
https://carigold.com/forum/threads/jud-ex-com-cryptocurrency-exchange-service.709663/post-27651833
https://www.okchanger.com/exchangers/Jud-ex-com



I believe there are similarities between those scam sites with byware(.)net and nokyc-noaml(.)cc




There may be additional sites like these. I believe the same Russian operator runs them and is targeting new victims. Please avoid using these services.

[albon]

If the domain is only 10 days old, how can they claim at the bottom “© 2015 - 2026 ByWare”? This is a clear contradiction.

Their site has not existed for 11 years as they claim, this is outright deception.  

byware(.)net | ARCHIVED

Registered On: 2026-03-13
Expires On: 2027-03-13
Updated On: 2026-03-15
Registrar: Tucows Domains Inc. IANA ID: 69
Age: 10 Days

I have looked at the both domains and indeed they use the same script with identical FAQ, ToS, and Affiliate Terms pages.. Also, There are no differences except for the logo and the domain name; the design and element layout are a 100% match.




nokyc-noaml(.)cc | ARCHIVED

Registered On: 2026-01-03
Expires On: 2027-01-03
Updated On: 2026-01-03
Registrar: Immaterialism Limited
Age: 2 Months 20 Days

Based on the source code of both websites, they share the exact same Tracker ID: 106889005. This confirms beyond any doubt that both sites are managed by the same person monitoring visitor traffic from a single dashboard and also, both platforms support the same languages (中文, हिन्दी, ES, PT, RU, FR, DE, UA) following the identical order and structural layout.

ByWare Yandex ID:

Code:

    <!-- Yandex.Metrika counter -->
    <script type="text/javascript">
        (function(m,e,t,r,i,k,a){
            m[i]=m[i]||function(){(m[i].a=m[i].a||[]).push(arguments)};
            m[i].l=1*new Date();
            for (var j = 0; j < document.scripts.length; j++) {if (document.scripts[j].src === r) { return; }}
            k=e.createElement(t),a=e.getElementsByTagName(t)[0],k.async=1,k.src=r,a.parentNode.insertBefore(k,a)
        })(window, document,'script','https://mc.yandex.ru/metrika/tag.js?id=106889005', 'ym');

        ym(106889005, 'init', {ssr:true, webvisor:true, clickmap:true, ecommerce:"dataLayer", referrer: document.referrer, url: location.href, accurateTrackBounce:true, trackLinks:true});
    </script>
    <noscript><div><img src="https://mc.yandex.ru/watch/106889005" style="position:absolute; left:-9999px;" alt="" /></div></noscript>
    <!-- /Yandex.Metrika counter -->

NoKYC-NoAML Yandex ID:

Code:

<!-- Yandex.Metrika counter -->
    <script type="text/javascript">
        (function(m,e,t,r,i,k,a){
            m[i]=m[i]||function(){(m[i].a=m[i].a||[]).push(arguments)};
            m[i].l=1*new Date();
            for (var j = 0; j < document.scripts.length; j++) {if (document.scripts[j].src === r) { return; }}
            k=e.createElement(t),a=e.getElementsByTagName(t)[0],k.async=1,k.src=r,a.parentNode.insertBefore(k,a)
        })(window, document,'script','https://mc.yandex.ru/metrika/tag.js?id=106889005', 'ym');

        ym(106889005, 'init', {ssr:true, webvisor:true, clickmap:true, ecommerce:"dataLayer", referrer: document.referrer, url: location.href, accurateTrackBounce:true, trackLinks:true});
    </script>
    <noscript><div><img src="https://mc.yandex.ru/watch/106889005" style="position:absolute; left:-9999px;" alt="" /></div></noscript>
    <!-- /Yandex.Metrika counter -->

There are no previous reviews for either site due to their recent registration. I strongly advise everyone to AVOID DEPOSIT ANY FUNDS TO THESE PLATFORMS.

Also, the representative’s account ^[ByWaRe] is a reactivated dormant account with a recent password reset, a common sign of a bought/hacked account used for scamming.

[NoKYC-NoAML.CC]

I believe there are similarities between those scam sites with byware(.)net and nokyc-noaml(.)cc

It is quite telling that you accused both us and ByWare of being a scam simply because we use the same website engine. I can see that you have been posting everywhere about how similar our websites look, but what exactly does that have to do with fraud?

People like you try to destroy others’ reputations with baseless assumptions, apparently to promote your own exchange service and get rid of competitors. We work honestly, and there have been no complaints against us.

[albon]

It is quite telling that you accused both us and ByWare of being a scam simply because we use the same website engine. I can see that you have been posting everywhere about how similar our websites look, but what exactly does that have to do with fraud?

People like you try to destroy others’ reputations with baseless assumptions, apparently to promote your own exchange service and get rid of competitors. We work honestly, and there have been no complaints against us.

Wow, your account was registered on February 13, 2026, and you haven't posted anything on the forum since then. Yet, you suddenly appear today right after the ByWaRe account was banned. Is that just a coincidence?



Also, you replied to OP but didn't address my discovery. The Yandex Metrika ID embedded in both websites is a personal account identifier; it is NOT a default part of any 'website engine' or script.

It’s also funny how you rushed to edit the source code on the ByWare site after seeing my post, but you forgot one thing: I have already archived your other website [HERE], so you can’t hide or modify anything now. The evidence is permanent.

[NoKYC-NoAML.CC]

It is quite telling that you accused both us and ByWare of being a scam simply because we use the same website engine. I can see that you have been posting everywhere about how similar our websites look, but what exactly does that have to do with fraud?

People like you try to destroy others’ reputations with baseless assumptions, apparently to promote your own exchange service and get rid of competitors. We work honestly, and there have been no complaints against us.

Wow, your account was registered on February 13, 2026, and you haven't posted anything on the forum since then. Yet, you suddenly appear today right after the ByWaRe account was banned. Is that just a coincidence?

Also, you replied to OP but didn't address my discovery. The Yandex Metrika ID embedded in both websites is a personal account identifier; it is NOT a default part of any 'website engine' or script.

It’s also funny how you rushed to edit the source code on the ByWare site after seeing my post, but you forgot one thing: I have already archived your other website [HERE], so you can’t hide or modify anything now. The evidence is permanent.

I don’t post anything on this forum because I’m currently based in Russia, but since this post touches on the reputation of my exchange platform, I naturally feel compelled to respond.

On top of that, we’re also acquainted with Byware, and they brought this post to my attention; in fact, we got to know them precisely because of the sale of this engine.

Does the fact that Yandex Metrics is still there mean that some kind of scam took place? Or what does that prove?

You are making serious accusations against us, but you’re backing them up with unclear evidence. Please provide proof of our dishonest actions!

You’ve spread unfounded rumors everywhere, but in reality, you’re only pointing out that our websites look similar—and that doesn’t prove anything at all!

[albon]

Nice try, but your explanation only makes it worse.

I don’t post anything on this forum because I’m currently based in Russia, but since this post touches on the reputation of my exchange platform, I naturally feel compelled to respond.

On top of that, we’re also acquainted with Byware, and they brought this post to my attention; in fact, we got to know them precisely because of the sale of this engine.

What’s the problem with being based in Russia? There are many Russian members here on the forum. You admitted that ByWaRe (a banned user) contacted you to respond here; in the eyes of the forum rules, this is clear ban evasion via a alt account. Your timing is too convenient to be a coincidence.

we got to know them precisely because of the sale of this engine.

Does the fact that Yandex Metrics is still there mean that some kind of scam took place? Or what does that prove?

A Yandex Metrika ID it is a personal tracking account. Having the same ID [106889005] on both websites indicates they are managed from the same control panel. No developer would sell an engine with their personal tracking ID unless he is the actual person running both sites.

You are making serious accusations against us, but you’re backing them up with unclear evidence. Please provide proof of our dishonest actions!

Why did you rush to delete it from the source code the moment I exposed it? You are clearly trying to hide what incriminates you, but you won't be able to escape the facts.

[logfiles]

The good news is that the ByWaRe profile has been banned which means any other linked profile should be banned since they are evading the ban. For now let's create flags for both profiles to protect newbies and guest users

ByWare(.)net were so quick to list themselves on platforms such as https://bitmixlist.org and https://bitlist.co. I don't know if the listings can just be done by anybody or must first get approved

They should be probably be deleted
1. https://bitlist.co/service/bywarenet
2. https://bitmixlist.org/#neverkyc-exchanges

[NoKYC-NoAML.CC]

Nice try, but your explanation only makes it worse.

I don't know whose situation this is making worse, but you're just talking nonsense—making baseless accusations and simply pointing out similarities between our site and Byware, claiming they're identical. But I don't deny it, and Byware doesn't deny it either—we do use the same engine. However, that doesn't mean we're scammers.

What’s the problem with being based in Russia? There are many Russian members here on the forum. You admitted that ByWaRe (a banned user) contacted you to respond here; in the eyes of the forum rules, this is clear ban evasion via a alt account. Your timing is too convenient to be a coincidence.

You’re quite the fantasist—I’ve already noticed that. You’re trying to latch onto something, but you don’t know what else to come up with to discredit us. I created an account here right after launching my exchange; the fact that I haven’t created a thread here yet is my own business—it’s up to me where to post it and where not to.

A Yandex Metrika ID it is a personal tracking account. Having the same ID [106889005] on both websites indicates they are managed from the same control panel. No developer would sell an engine with their personal tracking ID unless he is the actual person running both sites.

You probably don't quite understand what a Yandex Metrica ID is. With the same ID, it cannot retrieve data from two different websites using a single account—that's simply not possible. We don't use the Yandex account at all; this entry is just set by default in the engine so that users can set up a Yandex account and link their entry.

Why did you rush to delete it from the source code the moment I exposed it? You are clearly trying to hide what incriminates you, but you won't be able to escape the facts.

I've already noticed that you often make up facts that don't exist; I didn't delete anything

[rat03gopoh]

I don't know whose situation this is making worse, but you're just talking nonsense—making baseless accusations and simply pointing out similarities between our site and Byware, claiming they're identical. But I don't deny it, and Byware doesn't deny it either—we do use the same engine. However, that doesn't mean we're scammers.

That's a valid suspicion; scammers have been caught doing the same thing for years: cheap templates and a one-time license fee. If one domain is terminated, there's no need to wait for further evidence for the next ones. Don't pretend you don't know how it works.

[logfiles]

There may be additional sites like these. I believe the same Russian operator runs them and is targeting new victims. Please avoid using these services.

I am not saying the service maybe linked to the ones above, but I did notice some striking similarities with this one as well, and it was also announced recently in the currency board
- exmymoney.com

The did use a different colour theme but most of it is the same as the other two. I hope it's just a coincidence.

[NoKYC-NoAML.CC]

That's a valid suspicion; scammers have been caught doing the same thing for years: cheap templates and a one-time license fee. If one domain is terminated, there's no need to wait for further evidence for the next ones. Don't pretend you don't know how it works.

The fact is, the only thing that has been proven in this thread is that we use the same engine as the byware website, but we don’t deny that, and there’s nothing illegal about it.

Please also note that neither we nor Byware are involved in any fraudulent activities. As for the fact that other sites have been blocked, we have absolutely no connection to them, and this topic does not discuss any connection to them at all; no evidence is provided, just an assumption.

You cannot make such accusations of fraud based on the fact that several websites use the same engine, especially when none of them are engaging in any fraudulent activities!

[Trêvoid]

There may be additional sites like these. I believe the same Russian operator runs them and is targeting new victims. Please avoid using these services.

I am not saying the service maybe linked to the ones above, but I did notice some striking similarities with this one as well, and it was also announced recently in the currency board
- exmymoney.com

The did use a different colour theme but most of it is the same as the other two. I hope it's just a coincidence.

The website has been stopped

Sorry, This site has been stopped by the administrator，Please contact the administrator for details.

apparently to promote your own exchange service and get rid of competitors. We work honestly, and there have been no complaints against us.

trust me i have a very good legit client base that i don't even do ads,i just bump my thread and hunt down scammers.