New iGaming Scam Network Clones Casino Sites, Funnels Deposits, and Runs a Telegram Support Operation

Fraudsters are cloning well-known iGaming sites, pushing victims through AI-generated social videos, and then using fake support to extract deposits and fee payments. For PSPs and operators, the useful detail is not the theatrics — it is the infrastructure: mirror sites, rotating domains, hosting providers, Telegram coordination, and crypto settlement.

1. Victims are first shown an AI-generated video on social media, usually featuring a recognizable blogger or streamer allegedly handing out bonuses to new users with the usual “only today” pressure. The user is then redirected either to a clone of a casino site or to a Telegram channel filled with staged testimonials about successful withdrawals.
2. On these mirrors, the win rate is controlled manually. After registration, bonus funds are made to appear as a large balance on screen, and the real scheme starts only when the victim tries to withdraw. At that point, the case is handed to a separate support team that pushes the user to deposit real money under different pretexts, from a small “verification” payment to a fee for faster withdrawal.
3. The network is not a one-off clone job. More than one hundred Mellstroy Game copies were found, along with separate mirrors of Stake, Vavada, and other known platforms. The operators have built supporting infrastructure so that working domains are handed to scammers on a turnkey basis, and when one mirror gets blocked, another appears immediately.
4. Inside the operation, the setup looks uncomfortably like a standard affiliate program: traffic stats, ready-made domains, personal managers for each performer, and bespoke terms for anyone bringing in enough “clients.” New webmasters are recruited through conventional advertising, and some reports say ordinary scammers receive 60% to 80% of stolen funds. Payments are made exclusively in cryptocurrency, then run through mixers and converted to fiat with immediate withdrawal options.
5. The new details collected by iGaming Redaction include data tied to the coordinator Суб___та Роман Дмитриевич, already reported to law enforcement, as well as developer Троценко Артём Алексеевич, employee Ильминский Дмитрий Андреевич, and TikTok and Telegram coordinator Салмин Максим Максимович. Fresh Telegram accounts linked to the operation include @frenki888, @flehksa, and @HARIU4SS.

Infrastructure connected to the scheme was also tied to hosting providers AlexHost, KnownSRV, and Cherry Servers, plus the IPs and subnets 217.156.8.37, 217.156.8.38, 217.156.8.39, 217.156.8.40, 194.145.208.0/24, 194.145.208.104, 77.81.121.122, and 84.32.96.44. According to the collected data, 77.81.121.122 is where Mellstroy and Stake overlap, while 84.32.96.44 is an old XSlots IP.