Emerging Ponzi Scheme Scam Network: Early-Stage Risk Warning for Global Investors

Although no large-scale public complaints have yet surfaced, we have identified a coordinated cluster of suspicious investment platforms exhibiting strong characteristics of organized fraud operations.

These platforms operate across English-, German-, and Chinese-speaking markets, using AI trading narratives, ICO hype, and elite community branding to attract investors. The structure, domain registration patterns, technical architecture, and social media behavior strongly suggest systematic fraud preparation consistent with early harvesting stages.

This report aims to provide a proactive risk alert before large-scale victimization occurs.

Contents

01

1. Overall Fraud Characteristics

02

2. Multi-Language Targeting Strategy

03

3. Core Marketing Hooks

04

4. Identified Suspicious Domain Network (40 Platforms)

05

5. Society.com Cluster (U.S. Address Masking)

06

6. German-Targeted Alliance Cluster (.de)

07

7. Impersonation of Major Institutions

08

8. Secondary Harvesting (Recovery Scam Layer)

09

9. Four-Stage Pig-Butchering Model Observed

10

10. Conclusion

1. Overall Fraud Characteristics

1.1 Centralized Domain Infrastructure

A notable pattern is that the majority of domains are registered via Gname.com Pte. Ltd., a Singapore-registered ICANN-accredited registrar established in May 2020.

Key technical traits:

• Bulk domain registration under a single registrar
• Extensive use of mobile H5 structures such as:

web.xxx.com/#/

• “#/” hash routing typical of Single-Page Applications (SPA), commonly built with Vue or React
• Highly modular templates allowing rapid logo replacement and brand swapping

This indicates a scalable, template-driven fraud factory rather than independent businesses.

2. Multi-Language Targeting Strategy

Unlike traditional scam models that primarily target Chinese-speaking communities, this network shows a more evolved structure:

• Base language logic is Chinese (most fluent version)
• Primary harvesting in English markets
• Precision targeting German investors via localized domains (.de)
• Some sites default to German upon opening
• Websites support English / German / Chinese, occasionally French and Italian

This reflects an upgraded, globally targeted precision scam model.

3. Core Marketing Hooks

Common narratives across platforms include:

• AI quantitative trading systems
• AI trading tool sales
• ICO participation opportunities
• Web3 exchanges
• High-leverage contract trading
• Staking & mining
• “Elite communities” and “co-learning groups”
• “Public welfare” charity activities

To accelerate deposits, many platforms use extreme lottery incentives such as:

• iPhone 17 Pro Max giveaways
• 5oz physical gold
• 10,000 Bitcoin jackpot campaigns

This marks a shift: instead of setting hooks later in trading groups, they now pre-screen and aggressively incentivize high-value targets from the start.

4. Identified Suspicious Domain Network (40 Platforms)

Below are platforms showing structural similarities and coordinated traits:

Exchanges / Trading Centers

• HJC Exchange – https://hjccoins.cc/
• PulseSun Exchange – https://web.pulsesun.com/#/
• Liexs Digital Asset Center – https://web.liexs.com/#/
• Beuce Digital Asset Center – https://web.beuce.com/#/
• Ksaok Digital Asset Center – https://web.ksaok.com/#/
• Chobes Digital Asset Center – https://web.chobes.org/#/
• Ktrowe Digital Asset Center – https://web.ktrowe.com/#/
• ZEAKS Trading Center – https://web.zeaks.org/#/
• LEXINOVA Trading Center – https://web.lexinova.com/#/
• EMERALDWISDOM Trading Center – https://web.emeraldwisdom.com/#/
• HIGHTITAN Trading Center – https://web.hightitan.com/#/
• DURALUMEN Trading Center – https://web.duralumen.com/
• Quantum Vault Trading Center – https://web.qvtcoinese.com/#/
• AIXEBIT Exchange – https://web.aixebit.com/#/
• Yeahchain Exchange – https://web.yeahchain.com/#/

Investment Alliance / Union

• ProfitShock Investment Alliance – https://profitshock.com/
• Miqesia Investment Alliance – https://miqesia.com/
• Eramls Investment Alliance – https://eramls.com/
• Acenix Investment Alliance – https://acenix.com/
• Searel Investment Alliance – https://searel.com/
• Atrish Investment Alliance – https://atrish.com/
• Scatil Investment Alliance – https://scatil.com/
• Prometheus Investment Alliance – https://prometheus-alliance.de/
• Tethys Investment Alliance – https://tethys-alliance.de/
• EraMix Financial Union – https://eramix.com/
• DualHeart Financial Association – https://dualheart.com/
• WelcomeVille Investment Association – https://welcomeville.com/
• Mindzo Investment Union – https://mindzo.com/

Society / Community Model

• Harborstone Society – https://harborstonesociety.com/
• Oakstone Society – https://oakstonesociety.com/
• Boiling Point Society – https://boilingpointsociety.com/
• Inningz Wealth Circle – https://inningz.com/

Prosperity / Capital / Group Branding

• Goldmanre Prosperity Group – https://goldmanre.com/
• Elitepalace Prosperity Group – https://elitepalace.com/
• Nalera Prosperity Group – https://nalera.com/
• Gainstra Capital – https://gcgcgc.com/
• Neoster Global – https://www.neoster.com/#/
• NOVA COLLECTIVE INVEST – https://novacollfdn.com/
• Wellington Harbor Cap – https://web.wellingtonharborcap.cc/#/

(NOTE: NOVA COLLECTIVE INVEST appears multiple times in observed materials.)

5. Society.com Cluster (U.S. Address Masking)

Examples:

• Harborstone Society

  100 N Howard St Ste R, Spokane, WA

• Oakstone Society

  3400 Capitol Blvd SE Ste 101, Tumwater, WA

These addresses appear copied from unrelated businesses and may correspond to virtual offices.

Operational pattern:

• Join community
• Purchase AI trading tools
• Participate in high-value lotteries
• Emotional binding through “elite circles”

6. German-Targeted Alliance Cluster (.de)

• Prometheus Investment Alliance
• Tethys Investment Alliance

Characteristics:

• Multilingual sites
• Statement: “U.S. company serving Germany, therefore no German VAT ID required”
• Mentor-guided trading model
• Three-stage harvest:
1. Paid course
2. Charity participation
3. “Tax” payments before withdrawal

This matches high-trust, relationship-driven pig-butchering scripts.

7. Impersonation of Major Institutions

Certain platforms attempt credibility theft by mimicking established financial institutions such as:

• Goldman Sachs
• Wellington Management

Examples:

• Goldmanre Prosperity Group
• Wellington Harbor Cap

Physical addresses listed often correspond to shared office spaces.

The strategy relies on brand confusion and investor trust in globally recognized institutions.

8. Secondary Harvesting (Recovery Scam Layer)

Since late January, additional accounts have appeared on social platforms claiming to be:

• “Anti-fraud experts”
• “Fund recovery specialists”

Some even operate websites such as:

• https://tracingfrauds.com/

They claim to have internal channels to retrieve frozen funds, but instead demand:

• Processing fees
• Software fees
• Legal deposits

This strongly indicates a second-phase recovery scam targeting previous victims.

9. Four-Stage Pig-Butchering Model Observed

Stage 1: Lead Generation

• Social media ads (fake celebrity personas)
• Instagram, Telegram, WhatsApp outreach
• AI voice cold calls
• Free book / free stock recommendation websites
• Fake attractive personas copied from other platforms
• Invitation to investment groups

Stage 2: Trust Building

• High-win-rate speculative stock trades
• Live stock/forex classes
• Gradual introduction of “exclusive” platforms

Stage 3: High-Capital Entrustment

• Contract-based “agent trading plan”
• Promise of 2–3x principal within 3 months
• 10% profit share if successful
• Withdrawal blocked by:
• “Tax payment”
• “Compliance review”
• “Money laundering audit”
• Victims guided to take loans; funds credited directly to fake trading app balance

Stage 4: Large-Lot Internal Discount Trading

• “Internal preferential gold/oil futures”
• 1000+ lot trades
• Additional excuses to block withdrawals
• Charity pressure, tax demands, regulatory review claims

10. Conclusion

The structural similarities across domain registration, technical architecture, branding templates, multilingual targeting, and social engineering scripts strongly suggest an organized, scalable fraud network operating in early-harvest phase.

Even though widespread public exposure has not yet occurred, the behavioral patterns align closely with advanced pig-butchering syndicates previously observed.

Investors are strongly advised to:

• Verify regulatory licenses independently
• Avoid platforms promising guaranteed or unusually high returns
• Be cautious of AI trading tool sales combined with investment solicitations
• Treat “recovery experts” requesting upfront fees as high risk
• Never send funds to unverified crypto exchanges or ICO platforms

Early awareness is the most effective protection.