Back to the archive
    ARC-001CONFIDENCIAL · AnonimizadoCRÍTICO

    Brand impersonation, fraudulent infrastructure and Sha Zhu Pan scheme

    Active fraudulent domain impersonating a consumer-electronics multinational present in 15+ countries. The visible layer concealed a financial-fraud infrastructure with JWT linkage to winaopp.com, TRON receiver wallets and a money-mule network. Passive investigation only.

    Analysis type
    OSINT investigation · Digital fraud
    Sector
    Retail · Consumer electronics
    Status
    Closed
    Date
    2025
    OSINTSha Zhu PanTRONJWT linkageMule accountsBrand impersonation
    01

    Context

    • ·Passive detection through advanced search operators (combosquatting + typosquatting).
    • ·Non-official TLD, recent registration (<60 days), basic DV SSL, visual content scraped from the legitimate site.
    • ·Financial-data capture forms absent from the real brand and references to an invented 'premium programme'.
    02

    Methodology

    • ·WHOIS · DNS · passive recon with Shodan, Censys, URLScan, Wayback.
    • ·Front-end code inspection without active interaction with the backend.
    • ·OSINT chain analysis (TronScan, Breadcrumbs) on receiving TRC-20 wallets.
    • ·Correlation of JWT tokens and external endpoints to map infrastructure.
    03

    Findings

    01Active and indexed fraudulent domain
    CRÍTICO
    02JWT linkage with winaopp.com platform
    CRÍTICO
    03TRON wallets receiving funds
    CRÍTICO
    04Network of ≥7 documented mule accounts
    ALTO
    05Private WHOIS · Panama Shield
    ALTO
    06No prior report in VirusTotal/PhishTank
    MEDIO
    04

    Operational impact

    • ·Massive exposure of legitimate-brand customers to direct financial loss.
    • ·Reusable backend infrastructure (JWT + winaopp.com): ability to scale similar campaigns against other brands at marginal cost.
    • ·Private WHOIS + Cloudflare + TRON + non-cooperating jurisdictions → legal attribution highly unlikely.
    05

    Full document

    RESTRICTED ACCESS
    14 pp· 89 KB· PDF

    Document from the private archive

    This report is part of Zero101OSINT's private research archive. Access is individual, logged and traceable. No spam, no mailing list.

    Basic privacy information. Project: Zero101OSINT. Legal identity of the controller: pending owner confirmation. Manage the requested document and record the access request.

    Technology and email providers may process the submitted data. Legal basis, retention periods and international transfer arrangements remain pending owner confirmation. This request does not authorize advertising.

    Rights: access, rectification, erasure, objection, restriction and portability, where applicable. Contact: contacto@zero101osint.com. Privacy policy.

    PDF delivered through a temporary signed URL. The access request is recorded.