Scam Address Labels

Deposit addresses that reported scam platforms hand out, and nothing else. Each one was captured from the site’s own deposit screen, then verified on a block explorer. Where the address links directly to a known service, that link is recorded too, because that is the part an AML team can act on.

Published by the platform. Not proven to be held by it. Read “Published is not controlled” below before you screen against any of this.

Every row carries the write-up that documents it, so you can check the work.

Scope, deliberately narrow

In: the address a reported scam platform published as its deposit address, and a direct link from that address to a known service.

Out: cash-out addresses, intermediate collectors, exchange hot wallets, and anything a trace merely passed through. Those live in the write-ups where they have their context. A screening list full of counterparties is noise, and noise is what makes a label set useless.

Never in, on principle: addresses that paid a collector. Those people may be victims, and publishing a victim’s address as a scam address would be both wrong and harmful.

Published is not controlled

Read this before the rows. It is the most important thing on the page.

A row says a reported scam site published this address to take money. It does not say the operator controls it, and the two are not the same fact.

I tested that directly. A fake trading platform handed over six deposit addresses across six chains, in a live chat with its own operator, which is about as good as provenance gets. I traced all six. Not one was operator-controlled. Three had never been used at all. Three belonged to uninvolved third parties, including somebody’s ordinary account at a regulated exchange, whose normal activity would read as collection volume to anyone who assumed the site owned the address.

So a fake platform publishing an address it does not hold is documented behaviour, not a theory.

Every row carries control_status:

If a row is not established and it matches one of your customers, the innocent explanation is live: a scam site can print a stranger’s deposit address on its payment page, and that customer has done nothing. Freezing on a row from this file alone would be the wrong call.

What a row means, and what it does not

A row means a site that a named source reported as a scam published this address to take money, and the linked write-up shows what arrived.

A row does not mean the address is sanctioned, that its owner has been identified, or that a named platform has done anything wrong.

Some of these deposit addresses are themselves exchange deposit addresses. What that establishes is the address type, not the account holder. It may mean the operator collected straight into an account at a regulated venue. It may equally mean a customer’s deposit address was copied onto a scam site’s payment page. control_status on the row says which of those is supported.

Either way it is not a finding about the exchange. An exchange receiving a deposit is an exchange receiving a deposit.

If one of these is yours

If an address here belongs to your platform, it is worth your AML team taking a look. You hold the account records and I do not, so you are the only ones who can establish what sits behind a deposit address a reported scam site was handing out. Take it as a free lead rather than an allegation, and read control_status first.

The linked write-up carries the full transaction set, exact amounts and UTC timestamps, so there should be nothing to reconstruct.

afiliatemktplc[.]live

Read the full trace › 

Read this row set before you screen against it. The domain was registered on 2026-09-20. Every transaction on all three of these addresses happened before that date, so none of the money on them came from anyone using this site. The site is two days old and has taken nothing through the rails it publishes. All three are not established and a hit here is a lead about a published address, nothing more.

15hGjv1tTUoty2MGPzzYLhJkF2QahoYGaA labelled a Bybit deposit address by Arkham, MetaSleuth and Breadcrumbs. Three vendors in one ecosystem agreeing is not independent corroboration. Also the checkout address on the site’s own NFT store, so a purchase and an account deposit collect to the same place. First transaction 2024-08-04T07:41:47Z, last 2026-08-22T23:10:00Z. The 0.07903100 BTC figure is gross and, on a UTXO chain, includes change returning from the address’s own spends, so it is not an inflow figure.

Control: not established. A live operator, asked how to pay, pointed back at the deposit screen and called it “your trading account wallet address”, which is the only pointer toward operator control. The chain runs the other way: this address has over two years of history predating the site, which is not how an address the operation set up behaves.

TXyrzj428kRbC2rpay1NZEyFVdPAB4pD4y labelled a Bybit deposit address by Arkham and MetaSleuth. Its last sweep went to TU4vEruvZwLLkSfV9bNw12EJTPvNr7Pvaa, the same Tron address episode 002 reached. Last transaction 2026-09-14T23:20:03Z, six days before the domain existed.

Control: not established. Same basis as the Bitcoin rail on this site.

0x9c6b30ecfe4f136785b7554c9cf18e476d0e33e0 Etherscan carries the public name tag “Bybit: Deposit Address” on this address, and Arkham, MetaSleuth and Breadcrumbs agree. Served for both the ETH and the USDT-ERC20 rail. Its native transaction count is zero: it has never sent anything and has never paid a gas fee. Last genuine transfer 2026-07-07T18:30:35Z, 75 days before the domain existed.

Control: not established. Same basis as the Bitcoin rail on this site.

proderivfxt[.]com

Read the full trace › 

1AvNHAYFJAbm6vQGvX7qy8VdzUTWm5LL62 none. The address has never been used, so nothing can be said about what it is

Control: not established. published on the site’s deposit screen (E005) and never used. An address with zero transactions carries no control evidence in either direction

0x88c3d62860d59a51fa43adf84a20c040606ed3d6 the deposit address is itself an exchange deposit address: Etherscan labels it “Bybit: Deposit Address” and its Funded by field reads “Bybit: Deposit Funder”. Arkham agrees. Corroborated on chain by seven gas top-ups from the exchange funder and a sweep to an exchange hot wallet after each deposit Entity labels are attribution, not something the chain states, so a link like this cannot be verified the way an amount can. Some explorers do publish their own name tags, and where one does it is said so explicitly below.

Control: not established. published on the site’s deposit screen (E004) and nothing beyond that. The address is itself an exchange deposit address, so it belongs to an account holder, and no evidence identifies that holder as the operator rather than an unconnected customer. The 24,083.271289 USDT inbound may be a third party’s own account flow. No payment instructions have been obtained from the operator to test it

TSCcYez4hGLiDRna3kQXiwF6SbU6BX4GcL the deposit address is itself an exchange deposit address per Arkham and Tronscan. Corroborated on chain by a 20.000000 TRX gas delivery from the exchange funder followed by a sweep 3 minutes 3 seconds later Entity labels are attribution, not something the chain states, so a link like this cannot be verified the way an amount can. Some explorers do publish their own name tags, and where one does it is said so explicitly below.

Control: not established. published on the site’s deposit screen (E003). Exchange deposit behaviour identifies the address type, not the account holder. Same open question as the Ethereum rail on the same site

a1cryptotradings[.]com

Read the full trace › 

bc1qk078dgjfkrxu6upw749krxp5j8v8rws0hf8d3m the deposit address forwarded to addresses Arkham attributes to CoinCola, one hop out Entity labels are attribution, not something the chain states, so a link like this cannot be verified the way an amount can. Some explorers do publish their own name tags, and where one does it is said so explicitly below.

Control: circumstantial. published on the logged-in deposit screen (E002). The sibling collector bc1q9ukttq2pkqn5x9nf6866dyajntfl7avnhv5q96 funded this address’s first UTXO and the address route-tested to CoinCola 7 minutes 27 seconds later, which is how an address the operation set up behaves. Co-spend test closed negative and definitive: 17 spends, all single-input, so common-input ownership can never be established here

Schema

Method

Every trace follows one rule: explorer or nothing. No date, amount, address or direction is recorded unless it has been read off a block explorer, and no identifier is ever abbreviated, because address poisoning targets exactly the prefix and suffix that abbreviation preserves.

Verified against Etherscan and Blockscout on EVM chains, TronGrid and Tronscan on Tron, and blockstream.info cross-checked with mempool.space on Bitcoin. Graph tools are used to find the shape. Values always come off an explorer.

Corrections

Found an error, or want a row removed with cause? Raise it on the write-up linked in that section. Corrections get made in public and dated.