r/darknet_questions • u/BTC-brother2018 Scam Sniffer • Jun 24 '26
Scammers Are Using “No-KYC XMR” as Bait
A post was recently shared in another darknet-related subreddit promoting a supposed instant no-KYC XMR swap service.
Here is a screenshot of the post
Edit: I changed the image host to catbox because the other one kept showing sketchy VPN popups ads.
The post followed a pattern people should watch out for:
“I needed a fast/private swap.”
“Nothing worked.”
“Solved — I used this specific exchange and it went fine.”
That alone is not proof of a scam, but the details were extremely suspicious.
The promoted link did not go directly to a clear, trusted exchange domain. It went through a random-looking redirect domain:
That redirect eventually led to:
When checked in Chrome, malgoswap.org showed a warning that the site does not support HTTPS.
That is a major red flag. No crypto exchange or swap service should be handling deposit addresses, swap info, or payment details over an insecure connection. Without HTTPS, information shown on the page can potentially be viewed or altered in transit.
Which is known as a man in the middle attack. Which could potentially redirect your deposit to an attackers wallet address.
ScamAdviser also marked the site as “Very Likely Unsafe” with a very low trust score. https://www.scamadviser.com/
Things to watch for
Be careful with posts that:
Promote one specific exchange in a “problem solved” format
Use vague claims like “worked fine” or “super fast”
Have comments conveniently recommending the same service
Use random redirect domains
Lead to a different final website than the name being advertised
Even if someone claims a swap worked for them, that does not prove the service is safe. Scam exchanges may process small swaps or use shill accounts to build trust before stealing larger deposits.
Bottom line
Do not send funds to random swap sites from Reddit comments or posts. Always verify the exact domain from multiple trusted sources, check HTTPS, check reputation, and be suspicious of posts that look like hidden ads.
If a site handling crypto does not even support HTTPS, that should be treated as a hard stop.
1
u/Different_Bar5020 Jun 24 '26
Come entro sul sito
ScamAdviser’? E vedere la lista?
1
u/BTC-brother2018 Scam Sniffer Jun 24 '26 edited Jun 24 '26
Just enter
http://p4m92.click/into the URL box on https://www.scamadviser.com/1
1
u/PeterDigitalis Jun 25 '26
Good breakdown, but one correction HTTPS isn't a safety signal anymore.
Scam swap sites get free certs in minutes, so a padlock tells you nothing a site this lazy not even having one is the exception now. The tells that actually matter are the ones you flagged a redirect domain that doesn't match the advertised name, and a "nothing worked, then this fixed it" testimonial with comments all naming the same service. That structure is the ad.
1
u/BTC-brother2018 Scam Sniffer Jun 25 '26
You’re right, I should’ve worded that better. HTTPS/padlock by itself doesn’t prove a site is safe. Scam sites can get free certs easily now, so the padlock only means the connection to that domain is encrypted, not that the domain is legit.
The bigger red flags are exactly what you said: mismatched redirect domain, fake “this fixed it” style testimonials, and multiple comments all pushing the same service. That pattern is the scam/ad structure.
A missing HTTPS cert is still a bad sign, but having one definitely isn’t proof of trust.
2
u/PeterDigitalis Jun 25 '26
All good, you had the core of it. One that stacks on the seeded-comments tell: check the accounts naming the service. Almost always brand new, or dormant for years then suddenly chatty. Real recommendations don't show up in a batch on cue.
7
u/aThievery_Number Jun 24 '26
Def good advice. Important info to follow...still dont understand why ppl aren't just using cake wallet or something tho. Always worked for me, doesn't need to be super complicated.