About this article: The research was conducted by PWN-ALL, a commercial cybersecurity company. This article is based on the company’s own analysis and does not constitute an official statement from law enforcement agencies. Domains, IP addresses, bank details, login credentials, tokens, and personal information have been redacted to protect the victims, preserve the data for review by the relevant authorities, and prevent third parties from accessing sensitive information.

A call from the number +882

An incoming call was received from a number starting with +882.

This is not the country code for any specific country. According to the International Telecommunication Union’s classification, the code +882 is used for international networks. The prefix itself does not indicate fraud and does not allow the caller’s physical location to be determined.

The caller identified himself as an employee of a large investment company and offered returns ranging from 20 to 40% per year.

The conversation began something like this:

“Hello, is this Alina? My name is Avram, and I represent an investment fund from the United Kingdom…”

What followed was a typical investment scam scenario. Banks allegedly intentionally pay customers low interest rates, hinder transfers to investment funds, and prevent people from managing their own money.

Such schemes are often referred to as “pig butchering” scams. The operator doesn’t demand a large sum right away. First, they build trust, assess the person’s financial and emotional state, secure an initial small transfer, and only then begin to increase their demands.

We decided to continue the conversation to determine what technical infrastructure was associated with this call.

How the operator looked for a weak spot

A pre-prepared profile was used for the conversation:

  • a 38-year-old woman;
  • divorced and raising a child;
  • has no steady income;
  • owns an apartment.

During the first 50 minutes, the operator hardly discussed any specific investment instruments. Instead, he asked about her family, income, plans, and financial difficulties.

The answers received were immediately incorporated into the conversation. The pitch gradually shifted from an abstract opportunity to make money to a supposedly personalized solution: providing for her child, creating a steady income, and gaining independence from banks.

First, the operator downplayed the value of traditional financial instruments. Then he created a sense of a rare opportunity, identified an emotionally painful issue, and linked its resolution to the initial deposit.

For the selected profile, the main points of pressure were an unstable income and the child’s future.

A British fund not listed in any registries

Under the pretext of wanting to examine the offer in more detail, we asked them to send us the documents.

Shortly thereafter, a brochure was sent from a British WhatsApp number on behalf of Delegmed Investment Fund Limited. Almost simultaneously, the operator called again and continued the conversation, trying not to leave us any time to verify the information on our own.

The brochure contained the claimed return figures and a description of the investment products. The illustrations showed visual signs of being generative content, and a check of the embedded raster images confirmed this at the metadata level: the PNG files contained a C2PA manifest marked as having been generated by ChatGPT on July 14, 2026. C2PA is an open standard for digital content provenance: the manifest is added by a tool when the file is created and records how and when the image was generated. Metadata can be deleted or forged, so it doesn’t prove anything on its own, but in this case, it matched the visual evidence.

The company presented itself as a British investment fund, so we verified its exact name in two public sources:

  • the Companies House registry;
  • the Financial Services Register of the UK’s Financial Conduct Authority (FCA).

As of August 2, 2026, we found no exact match for the name Delegmed Investment Fund Limited in either Companies House—including records of active and dissolved companies—or in the FCA’s Financial Services Register.

Companies House provides public information about companies registered in the UK, including their status, address, directors, and document history.

The FCA states that almost any activity involving the provision of regulated financial services in the UK requires authorization or registration, and relevant companies must be verified through the Financial Services Register.

The absence of a name in the registers does not in itself prove the existence of a criminal scheme. However, it directly contradicted the operator’s claim that it represented a UK investment fund.

We examined two additional scenarios.

The first is a so-called “clone firm”: a scheme in which the name, registration number, or address of a genuinely authorized company is used, while only the contact information is changed. We cross-checked the details from the brochure against the records of authorized companies in the Financial Services Register: no matches were found. The second scenario involved the FCA Warning List, a public list of firms about which the regulator warns consumers that they are operating without authorization. As of August 2, 2026, the name Delegmed Investment Fund Limited were not listed there.

A pre-created personal account

After asking where exactly the investments were supposed to be made, the operator sent a link to a website in the domain zone .com.

The domain was registered on June 27, 2026, less than a month before the analysis.

The username and password had been created in advance. After logging in, the profile already displayed a name, phone number, and email address.

This information was known to the operators before the substantive conversation began. The source of this data could not be determined. It could have come from a data breach, a previously compiled database, a commercial source, or another campaign.

On the surface, the site mimicked an investment platform: it displayed a balance, transaction history, return metrics, and a form for funding the account.

Most of the pages were static. The personal account section worked differently: it collected browser and device characteristics, maintained a WebSocket connection, and dynamically retrieved specific values from another server.

When the deposit button was clicked, JavaScript sent the user’s account information and digital fingerprint to the server. In response, a string containing bank details and the current balance was expected, for example:

GB...IBAN...|0.00$

The server could return different details for different users. This allowed operators to change the account directly during a call without refreshing the main website.

After logging in, the user dashboard also accessed the route /me. At the time of analysis, it returned 404, but the client code indicated that the response could be used to load parameters for a specific account and save values to the browser’s local storage.

Dynamic DNS server

The main domain was almost entirely static, but the dashboard’s dynamic features accessed a separate server for Dynamic DNS.

An initial analysis revealed several accessible network services. Some of them appeared to be placeholders or simple decoys, but separate web applications with their own index pages and error handlers were running on two non-standard ports.

At this stage, the purpose of the applications remained unclear.

The turning point came the next day when the operator asked if the transfer had been completed. We indicated that we were considering sending the money, after which the operator asked us to upload a bank confirmation in PDF format.

To do this, they sent a direct link to a page like this:

site.com/my/statements/upload-form

There was no link to it in either the menu or the user dashboard.

The form did not submit the document to the main website, but to one of the Dynamic DNS services. When testing the processing of a large test PDF file, the application returned a detailed PHP error.

The Yii Framework debug mode was enabled on the server. Instead of the usual message, the user received a trace containing internal information:

  • Nginx and Yii versions;
  • directory structure;
  • the local user’s name;
  • server routes;
  • the path template for uploaded documents;
  • some environment variables.

Documents were stored in directories organized by year, month, and day. The name of one of the paths contained the following structure debildocument.

The code also used the notation balans in /home/pavlo/depositka-2/modul/resp.php:81

debildocument which looks like a combination of a Russian colloquial insult and an English word document and is a more noticeable linguistic clue than just balans. However, none of these names proves the developer’s nationality or the team’s location. The code could have been written by a member of a multinational team, copied from another project, or intentionally included a foreign linguistic trace.

How the admin panel was found

A debug response revealed environment variables, including:

  • ADMIN_URL;
  • ADMN_PASS.

The first pointed to the address of the administrative interface. The second contained the associated access credentials. We do not describe the sequence of further verification and do not publish the access credentials, as this could create additional risks for the victims.

The credentials were disclosed by the server itself in a debug response received during normal use of the form sent by the operator. We limited ourselves to documenting the structure of the control panel and the nature of the stored data to the extent necessary to determine the nature of the campaign and prepare notifications for the infrastructure owners: we did not make any changes, did not export the database, and did not use the access after collecting the information necessary for reporting to the hosting provider and the relevant authorities.

The dashboard was custom-built and hosted in a separate web application on the same infrastructure. It was not just a single table or a page left behind by accident: there were separate sections for different types of information.

The dashboard displayed the following separately:

  • profiles of potential victims;
  • payments and banking documents;
  • internal comments from operators;
  • contact processing statuses;
  • instructions and conversation scripts;
  • data from Telegram bots and external APIs;
  • technical logs;
  • investment website templates.

A person’s profile could include their name, contact information, marital status, an assessment of their financial capacity, amounts already deposited, objections, and recommendations for the next conversation.

Internal comments showed that various users—operators—were active in the dashboard, recording not only payments but also the individual’s psychological characteristics: whom they wanted to help, what they feared, why they were hesitant, and which arguments had previously proven effective.

We deemed it unethical to publish screenshots of the admin panel: the images would have revealed personal data, financial circumstances, and documents of the people in the database.

Telegram and Campaign Templates

The dashboard configuration revealed details of the Telegram Bot API and other external integrations used for internal notifications.

Within the infrastructure, we discovered a separate Dynamic DNS service used for the centralized upload of templates—including components used to assemble new versions of investment websites.

The combination of the admin panel, centralized cards, external integrations, and templates indicates that this was not a single operator with just one website. The infrastructure was designed to allow for the repeated launch of campaigns and the replacement of the front-end design without reconfiguring the server-side.

“Trigger an error” and connect to a computer

Internal documents mentioned RustDesk, TeamViewer, and other legitimate remote support programs.

The instructions suggested using them after establishing trust. The operator was supposed to trigger an error in the user’s account, present it as a problem on the user’s end, and offer to connect to “configure” or “unlock the operation.”

The WebSocket client’s logic followed this scenario:

  • ERROR|ERROR displayed a fake error;
  • ERROR2|https://... redirected the user to a specified address.

One of the redirection options led to the installation of a tool associated with hVNC. According to internal notes, this scenario was intended for particularly wealthy targets with estimated assets of $100,000 or more.

Android RATs and “scripts”—instructions explaining to the operator what pretext to use to convince a person to install the app and grant the necessary permissions—were stored separately.

How to Recognize This Type of Scheme

The campaign under investigation had several telltale signs:

  • an unexpected call offering an investment opportunity;
  • a promise of a 20–40% annual return;
  • pressure and criticism of banks;
  • an attempt to quickly move the conversation to a messaging app;
  • a recently registered domain;
  • a pre-created account with your personal information;
  • fund transfers to individuals or unrelated companies;
  • a request to upload bank verification;
  • a request to install RustDesk, TeamViewer, or another remote access tool;
  • a sudden “technical error” occurring specifically during the conversation;
  • additional taxes, fees, and charges for withdrawing funds.

One sign alone does not necessarily indicate fraud. A combination of several signs is sufficient reason to end the conversation and conduct an independent verification through official registries and the financial regulator’s contact information.

What to Do After a Transfer or Remote Connection

You must immediately contact your bank, report the fraudulent transaction, and request that the transfer be stopped or reversed, if still possible.

Save all correspondence, phone numbers, documents, website addresses, and payment details. Do not transfer additional funds under the pretext of taxes, fees, insurance, or account unlocking.

If an operator connected to your device, you must uninstall the remote access software and end any active sessions. If you suspect that other software has been installed, disconnect the device from the network and have it inspected by specialists. Change your passwords using another device that you know is secure.

A separate risk is secondary fraud. After losing money, a person may receive calls from individuals claiming to be lawyers, representatives of a regulatory agency, or asset recovery specialists. In exchange for the promise of a refund, they will demand an advance payment. Often, this is a continuation of the same scam or the use of data from a database that has already been compromised.

Notification of Providers

We have sent abuse notifications to the owners of the involved infrastructure

  • to the hosting provider of the static website;
  • the operator of the DDNS service that supported the dynamic part of the system;
  • the infrastructure provider whose network hosted the server with the administrative panel.

Each notification included indicators, a description of the activity, and a reference to the presence of third-party personal data. On August 4, information about the campaign was also submitted to the FCA via the form for reporting unlicensed activities and to law enforcement agencies. As of the time of publication: no responses have been received; the domain is active; the Dynamic DNS server continues to respond; the user dashboard has been disabled by the operator.

We did not contact the individuals whose card details were in the database. We have no legal basis to process this data or initiate contact, and a call or email from an unfamiliar company following a fraudulent campaign replicates the secondary fraud scenario described above. Server addresses, domains, and other identifiers are not being disclosed at the time of publication: part of the infrastructure may still be active, and premature disclosure would hinder our investigation.

Instead of a Conclusion

This story began with a single phone call and a promise of high returns.

Behind the voice of the “investment advisor” lay a system that combined a fake website, centralized profiles, payment documents, internal scripts, Telegram bots, templates, and remote access tools.

But the key discovery wasn’t the number of servers or lines of code.

The fake account dashboard didn’t just display a fabricated balance. It could respond to an operator’s command, generate an error at the right moment, and turn an ordinary phone conversation into a controlled technical scenario.

They weren’t selling investments. They were selling hope, turning fear for one’s family, the desire to get out of debt, or the wish to help children and grandchildren into a mechanism for exerting pressure.

So stay vigilant and always verify the information you receive—especially when it comes to money. Don’t trust high returns, a flashy website, or a persuasive “investment advisor” just because everything looks professional. Check the domain’s age, the legal entity, the financial institution’s license, and its details in official registries.