How to spot a scam syndicate
Organised fraud at scale. Hundreds of domains, dozens of wallets, coordinated playbooks.
What it is
A scam syndicate is a coordinated group of scam operators sharing infrastructure (hosting, domains, wallets), tools (phishing kits, bot networks), and playbooks (romance scripts, crypto pump schedules). One syndicate can run 50 or more active phishing domains, hundreds of social-media impersonator accounts, dozens of crypto wallets, and a steady pipeline of fresh victims.
The signs that point to a syndicate
(1) Many domains registered in the same week from the same registrar with the same WHOIS contact. (2) Multiple domains pointing to the same hosting IP block. (3) Many crypto wallets funded from a single source wallet, all deploying contracts with identical bytecode. (4) Social-media accounts with identical bio templates and overlapping follower lists.
Why syndicates are harder to fight than lone scammers
Take down one of their domains, they have ten more. Block one wallet, the funds are already moving. Report one social account, the next one is spinning up. The right response is not playing whack-a-mole on individual entities; it is mapping the cluster and going after the shared infrastructure.
What to do
If you encounter what looks like a single scam, report it to AVA. The intelligence graph cross-references it against everything else AVA has seen. Often the single entity you reported is the visible tip of a much larger operation, and AVA can show the connections.
Practice spotting this in AVA Scam Hunter
The more you see, the faster you spot. Play AVA Scam Hunter — free, 3 minutes, no signup needed.
📚 Read the full lesson at AVA Academy
This page is a quick spotter card. The full plain-English lesson lives in the AVA Academy. Read the Scam Syndicate lesson → or browse all 9 lessons.