Evidence verified October 18, 2026

Lookalike domains are impersonating Labrys

This is a public evidence page from Scam Detective’s published research. The real Labrys operates at labrys.io. The 11 domains below impersonate it — each with the corroborated evidence. Nothing here is a guess: every finding is backed by the independent sources listed further down the page.

11
Lookalike domains found
Critical
Overall risk level
3
Independent corroborating sources
October 18, 2026
Case verified
The evidence

Confirmed lookalike domains

Critical riskFake NFT platform — hyphenated lookalike on the real domain’s own TLD

labrys-nft.io

Registration profileNewly registered burner on the .io TLD — a hyphenated lookalike engineered to read as a sibling of the real labrys.io
First seenApril 2026, named in the company’s own warning
Evidence
  • Named in Labrys’s own April 2026 warning to clients — the company itself flagged this domain as having no connection to it.
  • Fronts a fake NFT platform, trading on Labrys’s real reputation as a blockchain consultancy to pre-answer the “is this legit?” question.
  • A hyphenated lookalike on the same TLD as the real domain (.io) reads like an official sister product — the strongest single trick in this family.
Critical riskFake marketplace — hyphenated lookalike on the real domain’s own TLD

labrys-market.io

Registration profileNewly registered burner on the .io TLD — same hyphenated lookalike pattern as labrys-nft.io
First seenApril 2026, named in the company’s own warning
Evidence
  • Also named in Labrys’s April 2026 warning — company-confirmed as fake.
  • Fronts a fake marketplace under the consultancy’s name; deposits or “marketplace accounts” opened there feed the operators, not any real platform.
  • Same TLD trick as the rest of the family: labrys-market.io reads as the real company’s marketplace vertical.
High riskSuffixed .io lookalike — “pro”

labrys-pro.io

Registration profileRegistered under the same suffixed-.io naming pattern — burner registrations echoing the real domain’s TLD
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • Part of the nine-domain suffixed family orbiting the real labrys.io — “pro” reads as a professional-tier sibling of the real company.
  • No connection to Labrys; the company’s warning named the family’s pattern, and this domain matches it exactly.
High riskSuffixed .io lookalike — “chain”

labrys-chain.io

Registration profileRegistered under the same suffixed-.io naming pattern — a blockchain-flavored suffix aimed at the company’s own market
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • “chain” is chosen to read as the company’s blockchain product vertical — the suffix is targeted at people who already associate Labrys with blockchain work.
  • No connection to the real consultancy; matches the family pattern named in the company’s warning.
High riskSuffixed .io lookalike — “crypto”

labrys-crypto.io

Registration profileRegistered under the same suffixed-.io naming pattern — burner registration aimed at crypto-asset seekers
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • “crypto” positions the fake as the company’s crypto arm — Labrys operates no crypto platform under any domain.
  • The classic use of a suffixed crypto lookalike: front a deposit-taking platform with a real company’s credibility.
High riskSuffixed .io lookalike — “agent”

labrys-agent.io

Registration profileRegistered under the same suffixed-.io naming pattern — burner registration
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • “agent” reads as an official agent/AI vertical of the real company — no such product exists.
  • Same family pattern: hyphenated .io lookalike with no connection to the real consultancy.
High riskSuffixed .io lookalike — “review”

labrys-review.io

Registration profileRegistered under the same suffixed-.io naming pattern — burner registration
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • A “review” lookalike exists to capture the trust-check traffic itself — people searching for reviews of the company land on the operation’s own page.
  • Trust-check hijacking is the most cynical trick in the family: the domain that looks like independent scrutiny is operated by the impersonator.
High riskSuffixed .io lookalike — “agency”

labrys-agency.io

Registration profileRegistered under the same suffixed-.io naming pattern — burner registration
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • “agency” mirrors the real company’s identity as a consultancy — the closest pure-clone name in the family.
  • No connection to the real Labrys; matches the family pattern named in the company’s warning.
High riskSuffixed .io lookalike — “de” (German market)

labrys-de.io

Registration profileRegistered under the same suffixed-.io naming pattern — a regional variant for the German-speaking market
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • The “-de” suffix reads as the company’s German-market site — regional variants of a global consultancy are exactly what a localized fake imitates.
  • Same family pattern; no connection to the real company.
High riskSuffixed .io lookalike — “gm”

labrys-gm.io

Registration profileRegistered under the same suffixed-.io naming pattern — burner registration
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • “gm” (“good morning”) is Web3 community vocabulary — chosen to read as the company’s own crypto-community presence.
  • Same family pattern: a hyphenated .io lookalike with no connection to the real consultancy.
High riskSuffixed .io lookalike — “ir”

labrys-ir.io

Registration profileRegistered under the same suffixed-.io naming pattern — burner registration
First seen2026, in our sweep of the Labrys lookalike family
Evidence
  • “ir” reads as an investor-relations page — the suffix targets exactly the audience most likely to trust a company-branded domain: investors.
  • Same family pattern; no connection to the real company.
The pattern

Red flags in this impersonation

  1. 01Same TLD, hyphenated name — the real company is at labrys.io; labrys-nft.io, labrys-market.io and every labrys-<suffix>.io variant is a lookalike engineered to read as a sibling product.
  2. 02A “review” domain (labrys-review.io) run by the impersonator itself — the trust-check traffic is being captured by the operation it’s meant to screen out.
  3. 03Crypto/NFT platforms fronted by a real consultancy’s name — deposits into any “Labrys” platform go to the operators, not a real product.
  4. 04The company’s own April 2026 warning is the reference list — if a domain is not labrys.io, treat it as fake until the company says otherwise.
  5. 05Suffixed families (nine variations observed) are the registration profile of an operation, not a company’s product lineup.
Independent confirmation

Who corroborates this evidence

Labrys’s own warning to clients (April 2026)

The company itself warned clients in April 2026 about labrys-nft.io and labrys-market.io — impersonators using its name to front fake platforms.

The .io TLD trick

The real company operates at labrys.io; the entire lookalike family registers hyphenated names on that same TLD, which makes each fake read as an official sister product — the single strongest pattern in this case.

Fake-crypto-platform pattern match

Fronting fake NFT/crypto platforms with a real blockchain company’s credibility matches the documented false-affiliation playbook — the same pattern documented in the StoneX and Fidelity cases on this site.

Full investigative write-up: Is StoneX a Scam? How Fake Trading Platforms Impersonate a Real Financial Company.

One-time payment

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29
Questions about this evidence, or need it for a takedown request? Email [email protected].
Not ready to buy?

Get the free Labrys impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.

For shoppers — not the brand team

Found a store claiming to be Labrys?

Paste the URL for a free instant risk score & verdict — a 0–100 score, a plain-English verdict (safe / suspicious / likely scam), and the red flag count, in seconds. Unlock the full report — all 5 red flags with evidence and a 3-step action plan — free with your email, or $0.50 one-time.

No subscription. Instant results — before you hand over a card number.

Other brand evidence pages
Corkcicle →StoneX →Fidelity →Owala →BrüMate →MrBeast →USPS →LEGO →AMLBot →Amazon →Huawei →Daniel Wellington →SodaStream →CurrentBody →Dreame →Grubhub →TikTok Shop →Ooni →Simple Modern →Vessi →Swig Life →Barefoot Dreams →Midsummer Agency →Grow & Convert →Wordibly →Arctoris →Staffology by IRIS →KeenLogic →Dotinum →Vosyn →All evidence pages