About the work

A closer look.

Worked examples. Three real traces I ran off live questions, free to read. Same method as the paid trace: start from what the thing shows the world, then pull the layer behind it, and cite every step. ——— 1) DEXGETO — a 25-day-old "exchange" with no email and no name Question (r/CryptoScams 1x98nlw): who is behind DEXGETO, the "exchange" pushed by arbitrage videos? - dexgeto.com registered 2026-09-24, 25 days before that post. One-year term, prepaid. Registrar Eranet International. Last changed the same minute it was bought. - Nameservers on Cloudflare, origin hidden. No MX record at all: a site calling itself an exchange has no working email. - Archived homepage is a generic template ("Deep Liquidity", "Security Comes First", a market table, a sign-up button); footer "(c) 2026 DEXGETO". No company, address, license, or named operator. - Gridinsoft flagged it "Cryptocurrency Scam", 1/100, on Oct 11, ten days after launch. Finding: nobody who wants to be named. That IS the answer. Receipts: reddit.com/r/CryptoScams/comments/1x98nlw/ | rdap.verisign.com/com/v1/domain/dexgeto.com | dns.google/resolve?name=dexgeto.com&type=MX | gridinsoft.com/online-virus-scanner/url/dexgeto-com | web.archive.org/web/20261019090616/https://dexgeto.com/ ——— 2) Escoin/ELG — the "legal services" coin sits on a St. Vincent shell Question (r/CryptoScams 1x9u6zt): a user sent ELG to escoin.ee on Oct 18, was asked for KYC to withdraw, then sat in "Under review" with no reply. - Estonia's .ee registry lists escoin.ee's registrant as FinCras InvCras Digital Services LLC (id 2559 LLC 2022), country St. Vincent and the Grenadines, registrar NETIM; record last changed 2026-09-19. - The site's own footer uses that name and "Suite 305, Griffith Corporate Centre, Beachmont, Kingstown", a registered-agent block used by thousands of offshore shells. - Behind Cloudflare (172.67.198.51); TLS cert issued Sep 19 2026, the same day the record moved. - The ELG token runs on BNB Chain: 0x755341c49f4427e43d99d8254a8dd87056f1ee00. Finding: not a law firm. A marketing front on an offshore LLC at a rented shell address, with a BSC token attached. Receipts: reddit.com/r/CryptoScams/comments/1x9u6zt/warning_escoinee_elg/ | internet.ee | escoin.ee/about-us/ | bscscan.com/token/0x755341c49f4427e43d99d8254a8dd87056f1ee00 ——— 3) Fittyx — another exchange's template under a 6-week-old MSB shell Question (r/CryptoScams 1x7bmo8): what is fittyx.com? - fittyx.com loads /static/coinexchange/ (an off-the-shelf layui build) and carries the exact error block and "Copyright2018-2026" footer as merindino.com, a "MERIDIAN" site claiming a Montana LLC. A snapshot of fittyx's own about page labeled its cert "MERIDIAN Exchange US MSB License Map." - The About page serves a FinCEN MSB registration for "FITTYX FOUNDATION", MSB #31000340076873, received 2026-09-04, 5050 S Syracuse St Suite 900, Denver CO, zero branches. FinCEN's own disclaimer on that PDF says registration is not approval and such claims "may be part of a scam". - fittyx.com registered 2016 but last changed 2026-09-01 (RDAP, GoDaddy). Its mobile API wap.fittyx.live answers in Chinese-format JSON. Finding: no operating company, no named humans. A fresh US MSB shell on a shared fake-exchange template. Receipts: reddit.com/r/CryptoScams/comments/1x7bmo8/ | fittyx.com/about/about_us | wap.fittyx.live/msb/msb_registration.pdf | rdap.org/domain/fittyx.com | merindino.com/about/about_us ——— Want one of these run on your coin, caller, or pitch? Order the paid trace on this shop: send the thing and where the question is asked. Same method, dated and cited, delivered in 3 days. If I cannot reach solid ground, you do not pay.