From red stamp to rebrand

User comedy_club (ID 85133) was banned on the Exploit forum as a SCAMMER — the red stamp.

Rather than leave the market, the operator is assessed to have spun up a minimum of ten clone brands that continue to run on the same servers, the same code, the same wallets, and the same contacts. What follows is the evidence that every exchanger in the set is one service wearing different signage.

Brands attributed to the cluster: ComCASH, RoboEx, Barbados Exchange, Secret Exchange (Secrex), Comedy, MotoMix, MixTwix, Karmaex, Satrus, Sicretex, plus a Telegram-only front telnet.service reported by forum users.

One mail server (SPF / MX)

Every domain sends mail from the same server. An SPF record is a DNS entry only the domain owner can set; it declares which server may send mail for that domain. MX and mail.* A-records for all domains resolve to a single host.

# reproduce for each domain
dig +short TXT roboex.cc
dig +short MX  roboex.cc
# all paths converge on one IP:
45.151.91.170

One codebase (build manifest)

A publicly reachable build manifest on comcash.cc contains the front-end entry points for every brand in one deploy.

curl -s https://comcash.cc/build/manifest.json | grep "main.ts"
resources/js/comcash/main.ts
resources/js/barbados/main.ts
resources/js/comedy/main.ts
resources/js/roboex/main.ts
resources/js/karmaex/main.ts
resources/js/satrus/main.ts
resources/js/sicretex/main.ts

Seven brands are one Laravel project with swappable front-ends — one developer, one deploy, one instance with theme switching. Not "the same engine anyone can buy." One instance.

Cross-domain shared assets

Each domain hosts the icons, logos, and images of other brands. Copying can't produce this: if site A merely cloned site B, only A would carry B's files. Here every site carries every other site's files — which is only possible with a shared file store: one server, one deploy.

Shared wallets — 81 of 81

A third party queried the /api/get/directions endpoint on each exchanger and found a 100% overlap of deposit addresses across the set.

# public endpoints, compare the returned addresses
https://comcash.cc/api/get/directions
https://secrex.cc/api/get/directions
https://barbados-exchange.org/api/get/directions
https://comedy-777.com/api/get/directions

Total wallet overlap means one cash register. A customer of any brand sends crypto to the same address as a customer of the banned scammer's Comedy Cash Out. This is the decisive break in the "white-label" story.

Telegram — the direct link

Chain: @amlchecksbot → @comedy_cash_out.

• @amlchecksbot (the "ComCASH" AML bot) lists in its own description: "Tech support: @comedy_cash_out."
• @comedy_cash_out — "Comedy Cash Out" — Telegram ID 5126978386 — is comedy_club on Exploit, the banned scammer.

Shared analytics identifiers

One Metrica counter is one Yandex account is one owner (tied to identity documents via Yandex ID). One verification token is one Google Search Console owner. Two "separate" projects, one account each.

MotoMix = Barbados (shared Tor address)

motomix.cc advertises the Tor address

barbmeidmo5u25oj2c7rfperjoy4cmkpznsd2thxapabyeiocbybbuad.onion

— the same hidden service used by Barbados Exchange (barbmix.io). Therefore MotoMix = Barbados = Comedy Cash Out.

AntiSwap.io — the captive "monitor"

The JavaScript on antiswap.io hard-codes the network's names:

function isComcashOrSecrex(name){
  return name === 'ComCASH' || name === 'Secrex';
}

• 4 of 11 "featured" exchangers on AntiSwap are ComCASH, RoboEx, Barbados, Secrex — the whole cluster.
• Two ComCASH banners on the home page.
• A Metrica conversion goal firing on ComCASH: ym(98680351,'reachGoal','comcash').

Assessment: AntiSwap is an affiliated monitor built to promote the network. Hard-coded brand names in the client JS are not ambiguous.

Duty-Free forum — founded by Comedy

Per the Telegram channel @proxy_bar (post 2454), the duty-free.cc startup is described as created by market figures posterman (luna11) and Comedy, with combined XSS/Exploit deposits cited above ₽20M.

If accurate, the banned scammer co-founded the very forum that hosts his own exchangers (Barbados, RoboEx, ComCASH) — a captive venue for a self-promoted scam set, not an independent marketplace.

Forum status: SCAMMER

Why "white-label" doesn't hold

The operators and sympathizers push a line: ComCASH is a white-label platform and the rest are its clients. One question dismantles it.

Their public reply concedes the rest by accident: "one analytics team, one cabinet," "one site engine," "shared registrar suggested by the developers," "an SMTP server we rent," "Moscow time zone." Each admission collapses another wall between the "independent" brands — and the reply goes silent on the bot chain, the seven-brand manifest, the shared Metrica counter, the 81/81 wallets, and the cross-domain assets.

Operational volume

On-chain tracing (TRON/USDT) points to an accumulation address funneling into hub wallets and onward to OTC desks and exchanges.

Why users should care

• Everything flows to a banned scammer. Customers of RoboEx, Barbados, and ComCASH don't know the same person who was stamped a scammer on Exploit is processing their funds.
• Centralized profiling. The admin panel captures IP, device, fingerprints, and full exchange history — all stored centrally.
• Full de-anonymization stack. Yandex.Metrica, Google Analytics, Facebook Pixel, and AdProfex run across the fronts.
• No real separation. Shared wallets, one server, one codebase — if one brand "exits," the money is already with the same operator.
• A captive forum. Duty-Free was co-founded by the operator to list his own exchangers. It is not a neutral venue.