BitXLucky
Scam Casino & Sportsbook Worker Panel
What victims see: identical template across 59 domains
Title pattern: {BrandName}: Crypto Casino Games & Casino Slot Games - Crypto Gambling
59
Domains
~1000
Est. Accounts
8
Crypto Networks
3
Server IPs (Aeza)
Key Finding: Platform Steals Registrations From Workers
We created a worker account, added test domains, generated promo codes, and registered a victim account with a promo code on the worker's domain. The registration never appeared in the worker panel (Users: 0).
The platform silently steals victim registrations from its own workers. Workers (traffers) are the lowest link in the scam money chain — they get scammed by the very platform they promote. This is common in the scam ecosystem, but BitXLucky is especially brazen about it.
This is also the lowest quality product of all panels we've analyzed — typos everywhere in the UI: "saport", "Logi", "Postsuk", "Warkers", "Vager", "col-vo asset", "Автовериф KYC" mixed with English.
Panel Screenshots
Home — Worker Dashboard
Worker "actual-currency", Payout 70%. Income: $0.00, Call deposit: 0, Users: 0. Empty Traffic and Deposits charts. Search by mail or transaction hash. Note: Users count stays 0 even after registering a victim — registrations stolen by platform.
Promo Codes — Creation & List
Promo code creation form: Custom/Global toggle, "The orders call-to-walk" (broken English), amount in USDT, "Vager" (wager), "Error in output" message. Table: Promocode, Currency, Amount, "Col-vo asset" (quantity — Russian transliteration), Amount of deposits, Error in output, Date.
API Documentation
API requires X-API-KEY header. Endpoints: Promo codes (POST custom/generate, GET/PATCH/DELETE by name, GET stats), Domains (POST create, PATCH by name), "Warkers" (POST create, PATCH update via /appeal/workers-ap/), Predictions (chicken_road game predict by difficulty/hash).
Settings — Basic Configuration
Commission on deposit: 1%, Commission on withdrawal: 1%, Minimum deposit: 100 USDT, Required deposit: 100 USDT. Error messages shown to victims when they try to withdraw: "Your withdrawal has been flagged as high-risk by our system. To proceed, please make a confirmation deposit with any cryptocurrency." Same message for KYC error ("KYC ошибка"). Auto-verify KYC in 30 seconds. "Presets of errors" section for custom scam messages.
Settings — Worker Account, Telegram, Live Support
Worker account trigger word (auto-verify if email contains the word). Example shown: [email protected]. "Postsuk in Telegram" (postback) — up to 5 taps, requires BotFather token, chat/channel ID via @JsonDumpBot. Live support settings: "Live saport online" toggle, greeting/welcome message toggle.
Telegram Actors (Project Support)
Registered: December 2023 / March 2024
Also: @netyvremeny, @imsot1r3d
Messages: 34,708 in 89 groups
Active: 2023-12-16 to 2026-01-31
Diversity: 87.72%
Replies: 27.76%, Media: 7.59%
Location: Voronezh (Воронеж №1 chat member)
Favorite group: Ебучий ADS чат 4.0
Top reply contacts
@bars_rrr (Mor9к ADS) — 898
@waveseII (WAVE SELL) — 290
@abszv (self) — 215
@proliv1 — 195
@neverzleep (Teddy) — 74
Notable groups
Frequent words
Psychotype Assessment
High aggression as compensation. Key pattern: "wants quick money, avoids responsibility, angry it's not working."
Unreliable in partnerships. Unstable in business. Loud but empty in conflict. Expendable in schemes — creates background noise of the scam ecosystem. Danger is not strategic but statistical.
Tech Stack (from source analysis)
Frontend
- Next.js (React) + Turbopack
- Sentry — release
[email protected] - OpenReplay session recording
- PostHog analytics
- Facebook Pixel (dynamic)
Backend
- NestJS (Node.js)
- JWT HS256 auth
- Zod validation
- Cloudflare CDN
- Russian + English mixed in UI and errors
Panel Sections (from sidebar)
Scam Error Messages (shown to victims on withdrawal)
Same message used for both "Error in output" and "KYC ошибка" — the confirmation deposit is never withdrawable.
Infrastructure — 59 Domains, 3 IPs
All domains behind Cloudflare. Backend on Aeza (International Ltd, Saudi Arabia + Group LLC, Moscow). Identical title pattern: {BrandName}: Crypto Casino Games & Casino Slot Games - Crypto Gambling.
Based on worker ID #1005, estimated ~1000 total accounts (workers + victims combined) — extremely low for a panel-as-a-service. Support recruits workers as affiliates from crypto/ADS Telegram chats, but the theft model is blatant and obvious. Libraries appear not updated.
postfinance-user-auth.com — bank phishing domain (PostFinance, Swiss bank) running the same casino panel template, indicating platform used for phishing beyond fake casinos.
IPs (Backend)
77.110.103.90
Aeza International Ltd, Riyadh SA
176.46.152.13:3000
Bala Cynwyd, US
77.221.151.196
Aeza Group LLC, Moscow RU
All 59 Domains (from scan)
Repository Contents
Collected by PhishDestroy | 2026-01-31