Inside a Crypto Scam Nexus

Inside a Crypto Scam Nexus maps a coordinated fraud operation centred on a single hosting IP, 8.221.100[.]222, used to host multiple domains including medaigenesis[.]cc, novacrypt[.]net and zzztd[.]com. The investigation, according to DomainTools Investigations, shows these sites form a connected infrastructure designed to drain cryptocurrency from victims, via browser extensions, fake iPhone configuration profiles and fake trading platforms.

The scam cluster also involves a Trust Wallet extension ID used to bolster a convincing “Fake Wallet Connect” prompt, along with an iOS WebClip approach via a Novacrypt mobileconfig that redirects to a phishing page on h5.novacryptmax[.]com. Researchers note related domains on the same server, such as n58[.]bet and ewnaI[.]com, and a malicious JavaScript ecosystem on zzztd[.]com that ties to an Android Trojan linked to anedhaude[.]xyz.

Passive DNS and registrar data tie these domains to a single actor or group, active on the IP since at least April 2025 and observed until August 2025, underscoring a broad, multi‑faceted fraud operation.