Over on Reddit's r/CryptoScams, a warning popped up about a sneaky scam dressed up as an offshore no-KYC VPS hosting service. According to user No_Limit_3355, the service — ServGhost (previously known as ServPrivacy, it switched domains in May 2026) — takes crypto payments but deliberately never credits them to your balance.

The scheme is about as cynical as it gets. You top up your balance in crypto, the transaction goes through just fine on the TRON network, but the website keeps hanging on a "payment can't be completed" status. And here's where it gets interesting: to contact support about that stuck deposit, the service demands... a new successful payment. As the post's author pointed out, the system straight-up says that "a new deposit is required to open a ticket". As proof, the user shared a wallet address. It shows over 700 incoming transfers from different people, which confirms this is a mass-scale scam.

The service looks like your classic fly-by-night operation — no contacts, no legal entity, nothing. The bait was aggressive bonuses for big deposits: like a $500 bonus on a $1000 deposit, or $2000 on a $2000 deposit. According to No_Limit_3355, it was greed and faith in those generous bonuses that made him believe the fairy tale.

In the comments, people tore into the victim's logic. User UpbeatFix7299 pointed out that in situations like this, there's no "support team" feeling sorry about your problems — you're just chatting with the scammer who already stole your money. User SecureWriting8589 added that scammers always play on your greed, and that's the biggest red flag that should've set off alarm bells. The author himself admits he's writing this breakdown not in hopes of getting his money back, but to document the scam pattern and keep others from making repeat transactions just to complain about the first loss.

Update from November 1, 2026: ServGhost turned out to be a network, not just one site

One of the most striking new details is the chain of renames. The domain servprivacy.com was registered on April 15, 2026; servghost.com on September 14, 2026 — so by the time the first complaints rolled in, it was about eight days old. A third domain, anonport.com, was registered in September 2026, owner hidden, claimed jurisdiction Saint Kitts and Nevis. Tellingly, the about page on servghost.com itself, as spotted by a user going by xzcat on LowEndTalk, straight-up admits the rebrand from servprivacy.com — so the move isn't exactly low-key.

The amount on the wallet got pinned down too. The TRON wallet TDcSEQzKSoQiwUMrHj4a2erozmAFhEvhUf that came up in the original writeup was holding, as of October 29 and per a count by a user named Zwei, over $60,000 — and the oldest transaction on it was dated just 62 days earlier. So that whole flow came in over roughly two months.

Then comes the part that, it looks like, turned this from a private complaint into something bigger. Zwei found that the service redirects visitors to the swapnokyc.io exchanger via a footer link, and that domain itself was registered a few weeks after servprivacy.com showed up — so it slots into the same series, time-wise. Then a shared payment address turned up: a USDT TRC20 of the form TMscdPi2hAL2sVjz4XZThA9PCW97rrnveP is used on servprivacy.io, anonport.com, and giftkong.com. Separately, proxy4g.co popped up with the same swapnokyc.io link in the footer, and nobanhost.com, per his words, turned out to be a near-verbatim copy of anonport.com. A Trustpilot review also mentioned servprivacy.io and giftmint.io with the same setup. Gift cards, mobile proxies, and hosting all under one address — a combo that on its own doesn't prove much, but together with copied pages and identical footers it hangs together.

The thread author himself, marto25, reacted pretty level-headedly: he agreed the network is wider than it looked, but admitted he's got no concrete proof of a link to SwapnoKyc yet. Zwei replied that for him it's already enough that several different scam sites are all pointing to one exchanger. This divergence is worth keeping in mind: part of the conclusions in the thread are built on coincidences rather than hard evidence.

The biggest chunk of facts came from LowEndTalk, where a discussion of nobanhost.com turned up — the same case where the hoster got handed a non-working address out of the IANA documentation range. In that thread, participants put together a table of around fifty domains with registration dates, registrars, and notes on which platform replaces which. The series logic reads right off the dates: dediprivacy.com gave way to hostonym.com, vpsoffshore.com to havenvps.com, chainvps.com to kernelvps.com, direwolfvps.com to vpswolf.com, powergpu.io to powergpu.ai, giftspend.com to giftkong.com, nokycesim.com to incognitosim.com, simsms.co to simverif.com — with the new domain showing up literally the day the redirect got switched on. The brands cover VPS and dedicated servers, GPUs, SMS numbers, eSIM, gift cards, crypto cards, and proxies.

An interesting detail about the "reputation" layer is laid out there too: nokyczone.com and nocensorhost.com are described as the operator's own review catalogs, and skipkyc.com as its own "reception desk" for reviews, with nokyczone.com tagging its own brands on its own site. On proxy4g.co, per the same table's data, a fake British company is published. All of this, of course, is the conclusions of the discussion participants, not court findings — but at minimum it explains why reviews of such services should be read with caution.

On infrastructure, the same thread compiled the following. The operations control panel, per xzcat's analysis, sits at pitpitat.com and is served through bit.hosting and gthost; some scripts openly use the Europe/Paris timezone, and the participants themselves mention French-language comms — meaning the trail leads into a French-speaking environment, which sounds a little ironic for an anonymous service. Domain-management automation across several registrars at once is mentioned: njalla, namesilo, namecheap, gname, godaddy, and nicenic. On October 14, two domains — dedisetup.com and swapnokyc.io — moved off Cloudflare to AvaHosting and alexhost, and per xzcat, the hostings took nearly 36 hours to respond to abuse complaints. Several domains are already dead: servhidden.com and vpscrypto.com got suspended by the registrars, and simsms.co, simnokyc.com, and mycryptocard.co stopped resolving.

What independent catalogs say today. Monerica tags servghost as a scam — though the card still carries the original description with promises like guaranteed no-KYC, direct Monero acceptance, and VPS from $7.50 a month, which nicely illustrates the gap between the ad and the actual status. In the NULL_ROUTE catalog, which the thread author himself runs, the service first went in as hosting with a 7.0 score in the October list of new projects, and then the score got cut to 3.0, the redirect button was disabled, and the card was moved to confirmed-scam status. Scam-Detector gave the service 24.7 out of 100. Curiously, in the list of projects the operator tried to push into Monerica, all are now tagged as scams — spotgpus, powergpu, vpsoffshore, simsms, sms-activate, cryptocard, nokyc-e-sim, and servghost itself.

The community reaction went wider than the thread. NotATether noted that now they'll have to keep lists not just of exchangers but of hosters too, and added he'd recently heard about the FBI shutting down another outwardly-decent hosting provider — participants agreed it was about virtualline. Zwei replied to that by saying at first glance ServGhost looks tidy: the site isn't thrown together, which is exactly why people fall for it. In LowEndTalk, a question about QloudHost came up separately — it was advertised in September as a "NoBanHost alternative" less than a month after NoBanHost was registered — meaning an SEO layer of "alternatives" already manages to form around such services, which is also a signal for users.

One more detail that might come in handy for the breakdown: nobanhost.com, per xzcat's data, set up a YouTube channel with an AI-generated voice for promotion.

Methodology caveat. A significant part of the new material leans on the table of one LowEndTalk participant and on the screenshots of a second participant in the Bitcointalk thread — none of this can be independently verified, and some of the domains already don't resolve.