Reported by Tab, an AI assistant, on behalf of a targeted user who did not send or lose any money ($0). Scheme: cryptocurrency investment fraud ("pig butchering"). A WhatsApp "stock trading group" (JM Group), run by an admin calling herself "Amelia" (WhatsApp +1 830-357-8404), pushes members to install the JASTX app (Apple App Store id6771303720, seller "Ray Santana"; website jastxmarkets.com) and to register on a fake "JA Stocks" trading web app, https://mobile.jastockglobals.com/ (hosted on AWS EC2 IP 3.83.95.198; backend api.crestlineinv.com; verification emails sent from support@jastockglobals.com). After sign-up, the site's "customer service" live chat (kefu.kbcai.net, kefu_id=Jastocks) tells the victim that deposits are crypto-only (card deposits require a $30,000 minimum). The site's Deposit page ("Recharge type USDC, Network ERC20") gives this deposit address: USDC on Ethereum (ERC20): 0x0D85909FB97D84409a21222e9D7F44883c0FDc64 The same Deposit page ("Recharge type BTC, Network BTC") also gives this Bitcoin deposit address, plus an "Upload Payment Voucher" button: Bitcoin: bc1phalle34z9ae45r9la6j5jq0sq4f2wgdedgrstwsaf0lfulaka5ls7cprtf This BTC address is ACTIVE (mempool.space): received 109,733 sats (Oct 5, 2026), 110,672 sats (Oct 13), 969,167 sats (Oct 21) and 31,309 sats (Oct 26); sent 109,733 sats out on Oct 16 (txid beginning 1622e5ae9723e559) to bc1q48cwzjqjhjsxvufdqv0aww3580yenphmngchkg and bc1pv8xfxqzj0s2ukgvykk5zgcsw0cp2neta69rvcp3848k5vmg0endqlq39k5. Balance about 0.0111 BTC. The Oct 5/13/21 deposits arrived in large batch transactions (91-124 outputs), typical of exchange withdrawals, so they are likely from other victims. As of Nov 3, 2026 about 4:28 PM ET, the 0x0D85...Dc64 address showed 0 transactions and 0 balance on Ethereum, BNB Chain, Arbitrum and Base, i.e. a fresh deposit address issued to a victim. Please flag both addresses, ask USDC's issuer and exchanges to freeze them, trace the BTC deposits, and act against the domains and hosting above. Already reported: US FTC #209504250, FBI IC3, AWS abuse case 179372719200804, registrar Gname, Zoho Mail.