luckquexa.com and 44 sister casinos: what we found
A template crypto casino, one of 45 near-identical sites listed in its own code. The code holds a scripted chain of payments demanded before any withdrawal, fake reviews that coach players to pay that "deposit", a copied license claim, and links to lookalikes of a real payment company's site.
Public since 2026-10-31. Reported on 2026-10-21 to Dynadot, Cloudflare, NiceNIC, Spaceship, IQWeb, StormWall, Heleket, Google Safe Browsing, the FBI's IC3 and the FTC.
Site: luckquexa.com (written out, not linked: don't open it with a wallet connected).
Status: All 45 sites were still up on 2026-10-23, two days after the reports. No takedown seen.
Findings
trap
Withdrawals are blocked behind a scripted chain of payments
The site's own /api/error-steps answer is a numbered list of "steps", each with an amount to pay, shown when a player tries to withdraw. The FAQ explains them in advance as "KYC, security confirmation, AML compliance review, tax compliance checks, and payment processor clearance". A promoRequired amount is kept next to the balance, and the withdraw page asks for a "Required deposit amount".
On withdrawal it also asks for a card number and cardholder name, after collecting government ID, proof of address and a selfie.
luckquexa.com/api/error-stepsthe site's FAQthe withdraw page's script
What to do: Don't pay anything to unlock a withdrawal. A real casino pays out from your balance; it never asks for a new payment first.
trap
Fake reviews coach players to pay the withdrawal "deposit"
/api/reviews returns 38 "customer reviews". 30 still contain the unfilled placeholder {brand}. Every timestamp ends in the same seconds and milliseconds (:41.075), so the dates are made up when the page loads, and reviews say "Player since 2024" on a site registered 2026-09-13.
Four exist to make the pay-to-withdraw step look normal, for example: "Yes, you do have to make a deposit to unlock your withdrawal, but don't let that scare you off...". The same 38 reviews, same names, appear on betquexa.com, goldentidecasino.com, crimsonvaultcasino.com and eagleplay.casino. The site's "reviews" link goes to trustpillot.io (two L's), a Trustpilot lookalike.
luckquexa.com/api/reviewstrustpillot.io
trap
A "wallet bonus" sends wallets holding $200 or more to a lookalike payment page
"Connect your crypto wallet, we'll calculate a personal bonus for your activity on other casinos." If the wallet holds less: "You need at least $200 USDT on your wallet to qualify for the bonus." The Claim Bonus button opens heleket-payment.cfd, and the deposit page's "Pay with Heleket" button opens heleket-payment.club. Both were registered in 2026 and sit behind a bot-blocking page. The real Heleket is heleket.com, on different servers.
We did not go past the block, so what these pages do to a connected wallet is not proven.
heleket-payment.cfd (NiceNIC, 2026-09-09)heleket-payment.club (Dynadot, 2026-06-09)
What to do: Never connect a wallet to claim a casino bonus.
warning sign
The slot games come from throwaway domains, not game studios
In a network capture of the site on a phone (2026-10-21, no login, no deposit), 28 of 30 MB came from pp.gmmm.click, registered 2026-10-01. The other game servers were play.global2api.org, pp.zcpvnfkadooapd.co.in and play.gmbl.org.uk, on DDoS-protection hosts in Dubai and Slovakia. Games served from the operator's own domains are run by the operator, not by a known studio.
pp.gmmm.clickplay.global2api.orgpp.zcpvnfkadooapd.co.inplay.gmbl.org.uk
warning sign
A copied license claim and an unfinished template
It claims New Era B.V., Curaçao company 157707, license OGL/2024/181/01. The same company and number appear on eaglequest.vip, which LCB.org rated unsafe with no valid license, and the "license" link goes only to the general Curaçao register page, which doesn't mention New Era, 157707 or luckquexa.
The brand shows as "Casino Casino", the contact emails are placeholders (support@casino.com), the Telegram link is just t.me, and the About page is the same {brand} template on every site: no team, no address, no company.
luckquexa.com footer and About pagecga.cw register pageLCB.org review of eaglequest.vip
info
One operator runs all 45 sites, and the app follows it to new domains
luckquexa's own /api/domains/siblings lists 45 sister casinos, all at Dynadot behind Cloudflare, registered in batches from 2026-05-25 to 2026-09-30. Their public /api/site-config files are identical apart from the name and domain, down to the same Facebook and TikTok ad pixel IDs, so the same ad accounts run all of them. The installed app keeps this list, so players follow it when a domain is shut down.
eagleplay.casinoeagleplay.wineaglestrike.betcrimsonvaultcasino.comgoldentidecasino.comnoirwheel.comreelquake.comspinmelo.comspinolix.combetglimera.combetnesta.comcasizonix.comreelquaka.comspinolya.comspinolyx.combetglimmex.combetnestix.comcasizonex.comjacknestix.comluckquexa.comreelflara.comreelquakka.comspinolyra.comspinorixa.comspinquexa.combetglora.combetnestya.combetolyra.combetquexa.combetzenx.comjackglimm.comjackolyra.comjackquexa.comjackspina.comluckblaza.comluckflara.comlucknestix.comreelcozyx.comreelnestix.comreelquexa.comreelzyx.comspinhavex.comspinmira.comspinorayx.comspinquelx.com
info
It finds players through Facebook and TikTok ads
/api/site-config lists 5 Facebook pixel IDs and 4 TikTok pixel IDs (the same on all 45 sites), and the code also loads Reddit, Pinterest, X and Google ad trackers. These IDs are what Meta and TikTok need to find the ad accounts.
Facebook 947543307877053Facebook 3495227700659111Facebook 1486415666644303Facebook 2378337426033000Facebook 1148417647539184TikTok DB6COQBC77UDJT302D70TikTok DB806L3C77UD150JCCPGTikTok DBAVLMRC77U1UMSUN870TikTok DBBLSHJC77U4SEFNDIVG
What we measured
| What | Result | How | Checked |
|---|---|---|---|
| luckquexa.com registered | 2026-09-13 at Dynadot, behind Cloudflare | RDAP (rdap.org) | Oct 21, 2026 |
| Minimum deposit and withdrawal | $45 deposit; $20 crypto / $50 card withdrawal | luckquexa.com/api/site-config | Oct 21, 2026 |
| Where deposits go | Unknown. Deposit addresses are made fresh per player and per coin after login, and none of the 45 sites has a wallet address in its public code, so the total taken can't be counted yet | /api/deposit/generate-address; public code of all 45 sites | Oct 21, 2026 |
| Sister sites still up | 45 of 45 answered /api/site-config, all with the same 5 Facebook pixel IDs | Each site's /api/site-config | Oct 23, 2026 |
Tools run on this project
Check it yourself
Every Pulse tool, live on mainnet, starting with whats_this. Paste a Solana address a casino or game asks you to pay, before you pay it.
Toolbox
Pick any tool, change any input, run it on mainnet, and reopen any call to change it and run it again.
Ctrl ↵ runs the tool
Run when unsure what an address is, before sending to it or passing it on. SOL sent to a token or program address can be lost for good. Read the docs
Response
Run the request to see the live response. The inputs are real mainnet data, so it works as it is.
Your calls 0
Calls you run appear here and stay in this browser. Open one to change its inputs and run it again.