🚨 ServGhost / AnonPort / ServPrivacy — Confirmed Scam | 700+ victims

[marto25]

🚨 SCAM REPORT — ServGhost / AnonPort / ServPrivacy

servghost.com · anonport.com · servprivacy.com

NULL_ROUTE has classified ServGhost as a confirmed scam. This post documents the pattern for the Bitcointalk community.

The scheme

ServGhost markets itself as offshore, no-KYC, crypto-only VPS hosting. The operation works as follows:

1. User signs up with token only (no email, no KYC)
2. User tops up balance via crypto (min $30, max $2000)
3. Transaction confirms on-chain — funds arrive in their wallet
4. Account never credits
5. Support ticket requires a new successful deposit to open

Quote from their own system: "a new deposit will be required to open a ticket."

This is not a technical glitch. It is the product. The support wall ensures victims pay twice before realizing the first payment is gone.

The bait

Aggressive bonus tiers were used to encourage larger deposits:
- $100 deposit → +$25 bonus
- $1,000 deposit → +$500 bonus
- $2,000 deposit → +$2,000 bonus

The bonus structure is designed to maximize the size of the initial deposit before the victim discovers nothing is credited.

On-chain evidence

Shared collection wallet (TRON):
TDcSEQzKSoQiwUMrHj4a2erozmAFhEvhUf

700+ inbound transfers from different senders — consistent with a shared collection wallet across all victims. Funds are collected and not returned.

Domain history

The operator has rebranded repeatedly:
- servprivacy.com — registered April 15, 2026 (Tucows)
- servghost.com — registered September 14, 2026 (Tucows) — 8 days old at time of first reports
- anonport.com — registered September 2026, owner hidden, St. Kitts & Nevis

The September rebranding to servghost.com followed exposure of servprivacy.com. AnonPort appears to be a parallel operation under the same pattern.

Independent sources

scamnot.me — approved investigation report
Reddit r/CryptoScams — original victim report
Monerica — classified as Scam Website
Scam-Detector: 24.7/100

NULL_ROUTE directory action

Score downgraded to 3.0. Visit button disabled. Listing marked as confirmed scam.

Full directory alert:
NULL_ROUTE Directory — Scam Alert post

Do not deposit funds to ServGhost, AnonPort, or ServPrivacy.

null_route / cetoc.org
cetoc.org/routen.html

[NotATether]

Crap, now I have to list hosting providers too? I might consider doing that after this.

Well, I feel sorry for the victims. It really does seem that lately we have to be careful with where we host our servers.

[marto25]

Thanks for the kind words.

Yes — hosting providers are increasingly part of the threat landscape, especially in the no-KYC space where operators are anonymous by design and there's no legal recourse when things go wrong.

ServGhost is a textbook example: anonymous operator, fresh domain, aggressive bonus bait, and a support wall that requires paying again just to report the first loss. The pattern is replicable and low-risk for the operator.

We'll keep documenting these in our directory as they surface.

null_route / cetoc.org

[NotATether]

Yes — hosting providers are increasingly part of the threat landscape, especially in the no-KYC space where operators are anonymous by design and there's no legal recourse when things go wrong.

Yeah there was very recently an FBI takedown of another seemingly normal-looking hosting provider I heard from the underground, and another host activated its "kill switch" and switched domains & infrastructure

I haven't been affected by any of this thankfully

[Zwei]

Shared collection wallet (TRON):
TDcSEQzKSoQiwUMrHj4a2erozmAFhEvhUf

700+ inbound transfers from different senders — consistent with a shared collection wallet across all victims. Funds are collected and not returned.

damn, that address alone holds more than $60k, and the oldest transaction is only 62 days old.

whoever is behind this scam knows what they are doing.
at first glance, everything looks good, and it's not some lazy scam website thrown together. no wonder so many people are falling for it.


(ghostarchive)

they are also redirecting users to a scam exchange (swapnokyc.io) with a link in the footer.
without a doubt, it was also made by them, as the domain name was registered just a few weeks after their first domain servprivacy.com:



according to this review on trustpilot, they also have another hosting site (servprivacy.io) and a gift cards (giftmint.io) scam site that link to that exchnage:


https://ca.trustpilot.com/reviews/6a9d9cac68ff04bac45546e5

and he is not wrong, because the USDT TRC20 deposit address is the same on both servprivacy.io and anonport.com as you can see:



it's a bigger network of scam sites.

there was very recently an FBI takedown of another seemingly normal-looking hosting provider I heard from the underground

you talking about virtualline, right?

[NotATether]

you talking about virtualline, right?

Yes. They looked alright.

[marto25]

Yes that is right, you are absolutely correct. The network of sites is quite larger and new domains are constantly being registered. But I am still trying to find concrete evidence for the connection with SwapnoKyc.

[Zwei]

Yes that is right, you are absolutely correct. The network of sites is quite larger and new domains are constantly being registered. But I am still trying to find concrete evidence for the connection with SwapnoKyc.

i think the fact that more than one scam site is redirecting users to them is more than enough proof for me.
i actually have found another gif cards scam website using the same USDT TRC20 payment address: TMscdPi2hAL2sVjz4XZThA9PCW97rrnveP

giftkong.com


(ghostarchive)

proxy4g.co

this one is also linking to swapnokyc.io in the footer.

nobanhost.com

this one is a 1:1 copy of anonport.com.
also while trying to look more into nobanhost.com, i found this post on lowendtalk, that list a much bigger list of those scam websites (it also includes the 4 above): https://lowendtalk.com/discussion/comment/4889086/#Comment_4889086

i hope this helps you.

[marto25]

Thanks Zwei — this is extremely helpful and changes the scope significantly.

Based on what you've found, this is no longer an isolated scam operation. It's a coordinated network sharing infrastructure.

Confirmed same USDT TRC20 deposit address:
- servprivacy.io
- anonport.com
- giftkong.com

Same deposit address (TMscdPi2hAL2sVjz4XZThA9PCW97rrnveP):
- giftkong.com
- proxy4g.co (linking to swapnokyc.io in footer)
- nobanhost.com (1:1 copy of anonport.com)

The lowendtalk thread you linked documents an even wider list.

On swapnokyc.io — multiple scam sites in the same network redirecting to a single exchange is a strong enough signal.