Loading story…
Multiple websites including fozawin.com, fusewin.com, fezowin.com, and prizedice.com were identified as part of a cryptocurrency scam operation that falsely invokes MrBeast and other creator-style prize promotions to lure victims. Reports say the sites use near-identical templates, fake licensing claims, and automated social-media outreach such as YouTube comments telling users they have won cash or hold a redeemable balance. After victims enter promo codes or create accounts, the platforms display fabricated winnings or account balances to make the offers appear legitimate.
The operators then allegedly demand advance payments in cryptocurrency or card-funded fees labeled as verification, taxes, withdrawal charges, or VIP upgrades, while never releasing any funds. Victims who continue paying are reportedly met with escalating payment requests, and those who stop may have their accounts banned. The pattern matches longstanding FTC warnings that legitimate sweepstakes and prize offers do not require upfront payment to claim winnings, and affected users were advised to stop sending money and seek chargebacks where card payments were used.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
The U.S. Federal Trade Commission published consumer advice warning that legitimate prizes, sweepstakes, and lotteries do not require upfront fees, taxes, or payments to claim winnings.
A report described fazowin.com as a fraudulent MrBeast-themed cryptocurrency casino in the same clone-based scam network. It said the site used fake balances, fake licensing details, and repeated withdrawal-related fee demands before banning victims who stopped depositing funds.
A report described prizedice.com as a cryptocurrency advance-fee fraud that used automated YouTube prize messages and promo codes to create fake balances. Victims were then asked to send an initial crypto deposit of about $100, followed by larger payments such as $200 or $1,200, without ever receiving a withdrawal.
Another report described fezowin.com as part of the same fraudulent crypto casino network using near-identical content, fake licensing information, and advance withdrawal-fee demands. The site allegedly cut off victims once they stopped sending more money.
A separate report identified fusewin.com as another fraudulent crypto casino in the same MrBeast-themed clone operation. It said the site used fake winnings and repeated verification-fee or tax demands before banning victims who stopped depositing funds.
An analysis described fozawin.com as a fraudulent cryptocurrency casino that falsely claimed association with MrBeast and used fake balances plus withdrawal-fee demands. The report linked it to a clone network that reused the same template and fake licensing details across domains including wezowin.com, xorawin.com, hasowin.com, and vazowin.com.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
onlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceconsumer.ftc.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers identified three criminal ecosystems hiding behind visually similar casino and adult websites: Chinese-language illegal gambling and money-laundering operations, fraudulent “scambling” platforms, and decoy sites hosting **PeckBirdy** malware command-and-control (C2) infrastructure. The Chinese-language gambling ecosystem spans more than 1.7 million domains and includes the FUNNULL CDN, Vigorish Viper, and Sable Squirrel networks; Sable Squirrel alone reportedly controls roughly 10,000 drop-caught expired domains, has spent more than $7 million acquiring them, and has been linked to 405 C2 domains and more than 31,000 malware samples communicating with its infrastructure. China-aligned actors have used PeckBirdy since 2023, embedding JavaScript and WebSocket C2 services in low-quality casino and adult sites, including `cache-cdn[.]org`, `cache-mcp[.]com`, `mcp-source[.]online`, and `githubassets[.]net`. Separate scam-gambling networks use polished gaming and wagering sites promoted through Discord and social media, often advertising fraudulent $2,500 celebrity-linked credits. Victims can place simulated bets and see fabricated winnings, but withdrawals trigger demands for cryptocurrency “verification deposits” and further payments that never result in a payout. Researchers linked at least 1,270 recently registered domains to one centrally managed operation through shared code, tracking, support infrastructure, and chatbot credentials; affiliates have also expanded this scalable scam model. Organizations should treat casino or adult-domain DNS activity as a potential security signal rather than solely a policy issue, especially where endpoints resolve multiple distinct PeckBirdy-related domains.
Sep 17, 2026
Fraudulent websites impersonating cryptocurrency gift-card provider **Bitrefill** are appearing in search results and directing shoppers through cloned checkout flows. The sites use typo-squatted, brand-plus-word, and internationalized/Punycode domains, closely reproduce Bitrefill branding, and offer cryptocurrency and apparent card-payment options before substituting attacker-controlled wallet addresses and QR codes for payments, reportedly as high as $1,990. Victims receive no gift cards or other products after sending funds, and cryptocurrency transfers generally cannot be reversed or charged back. The operators also appear to use commercial analytics to measure and improve conversion; Bitrefill says it is working with takedown specialists. Organizations should warn users to navigate directly to `bitrefill.com`, validate the registrable domain before payment, and never approve unverified wallet transactions or token permissions.
Sep 15, 2026
Cybercriminals used **FIFA World Cup** branding to lure football fans with fake lotteries, giveaways, and prize notifications designed to steal money or personal information. The scams promised winnings, tickets, or promotional rewards tied to tournament excitement, relying on social engineering and the credibility of a globally recognized event to make fraudulent messages appear legitimate. The activity highlighted a familiar pattern in which attackers hijack major sporting events to drive phishing and advance-fee fraud. Victims were pressured to respond quickly, share personal details, or pay supposed processing fees to claim non-existent prizes, underscoring the need for organizations and consumers to verify promotions through official channels and treat unsolicited prize messages with suspicion.
Jun 29, 2026