Analytics & Scammer Profile
Statistical analysis of 679 victim conversations • Psychological profile of the operator
Victim Engagement Funnel
Monthly Message Volume
Hourly Activity (Admin Work Schedule)
Activity by Day of Week
Chat Engagement Distribution
Scam Tactics Used (Admin Messages)
Victim Emotional Responses
Victim Language Distribution
Response Time Analysis
Scammer Psychotype — Operator Profile
Behavioral analysis based on 4367 admin messages across 679 conversations. This is NOT a clinical diagnosis — it is a behavioral profile based on observable patterns in the chat data.
🕑 Work Pattern
The operator works as a professional shift worker, not a casual scammer. Peak activity is 14:00–17:00 UTC (afternoon-evening Moscow time), consistent with a full-time job schedule.
Activity is highest on Tue and drops on weekends — treating scamming as a 5-day work week. Average response time of 94 minutes indicates the operator monitors multiple chats simultaneously (multi-tab support agent model).
The 14-month operation span (Jan 2025 — Feb 2026) shows long-term commitment and organizational structure, not an impulsive scheme.
💬 Communication Style
Template-heavy: The top 16 admin messages are repeated 5+ times each, indicating pre-written scripts rather than spontaneous conversation. The operator copy-pastes from a playbook.
Bilingual switch: Seamlessly switches between Russian and English depending on the victim. Writes fluent Russian (native) but uses stilted, formal English with support-speak (“Dear user”, “Our team”).
Average message: 132 characters — significantly longer than victim messages (74 chars). The operator writes long, authoritative-sounding explanations to overwhelm with fake detail.
🎭 Manipulation Playbook
The operator follows a consistent escalation pattern visible across hundreds of conversations:
Stage 1 — Authority: Impersonate Trust Wallet support (2153 messages). Establish trust through corporate language.
Stage 2 — Fear: Claim wallet frozen/blocked (306 messages). Invoke OFAC sanctions (214 messages). Create panic.
Stage 3 — Solution: Offer “asset replacement” as the only way out (253 messages). Demand deposits (215 messages).
Stage 4 — Escalation: Tight deadlines (82 messages). If victim pays once, demand more. If they resist — threaten jurisdiction transfer.
🧠 Psychological Traits
Low empathy, high patience: Maintains professional tone even when victims beg, cry, or threaten. Never breaks character. When a single mother (#1090) describes being unable to feed her children, the operator responds with another deposit demand.
Calculated, not impulsive: Uses 16 pre-written templates. Adjusts amounts based on perceived victim wealth. Demands more from victims who already paid (sunk cost exploitation).
Compartmentalized morality: Treats this as “work” — works shifts, follows scripts, has teammates (Dima, Andrey, Maksim). Likely rationalizes it as “victims are greedy/stupid.”
Risk-tolerant: Gives real Telegram handle (@Addmeks) to victims. Uses personal names in chats. Does not fear law enforcement — likely operates from a jurisdiction with low crypto fraud prosecution.
🎯 Victim Profiling
The funnel shows 679 victims engaged, 156 received demands, 39 claim they paid — a conversion rate of 5.7% from active to payment.
Target profile: Russian-speaking (3041/6008 messages = 51%), crypto-naive (ask basic questions about wallets/staking), emotionally invested (savings, pensions, borrowed money).
Repeat extraction: Once a victim pays, the operator ALWAYS demands more. The pattern is visible in top chats (446: 201 msgs, 1471: 141 msgs) — extended conversations mean repeated demands.
🎭 Emotional Manipulation Map
Admin messages use systematic emotional levers:
Victim responses reveal the manipulation is working:
Top Admin Message Templates (copy-paste scripts)
Messages sent by the admin that appear 5+ times verbatim — evidence of a scripted playbook.