CloudSEK Details ZHGUI Crypto Scam’s Fake Exchange Infrastructure and Laundering Network

Feb 2, 2026 · Original article ↗

Summary

CloudSEK describes ZHGUI as a cross-border crypto investment scam targeting Southeast Asian investors through messaging groups, fake trading dashboards and misleading regulatory claims, and traces suspected funds through TRON wallets to major exchanges.

Key points

ZHGUI allegedly recruits investors, especially Mandarin speakers in Southeast Asia, through WhatsApp and other social channels using fake investment mentors and staged profits.
The operation uses cloned exchange domains, fake trading dashboards and an invitation-based onboarding process to collect deposits, credentials and identity documents.
Withdrawals are reportedly blocked with explanations such as tax reviews or compliance checks after victims make larger deposits.
CloudSEK traced USDT flows through TRON wallets it associates with ZHGUI, including an aggregation wallet and an internal relay, followed by transfers to wallets labeled as belonging to major exchanges.
The investigation found a self-submitted FinCEN MSB registration, which the agency says is not verified or an endorsement of the business.
CloudSEK cites Malaysian reports of losses of about MYR 340,000 and MYR 3 million and says a ZHGUI iOS app has since been removed.
The researchers recommend monitoring associated domains and wallets, alerting financial institutions and exchanges, and coordinating with law enforcement.

Article Details

Attack Vectors: Operators recruit investors through WhatsApp and Telegram groups and social-media communities, posing as investment mentors and directing victims to invitation-only registration links.
Cloned exchange portals display fabricated trading activity and profits, collect credentials, wallet information, and KYC data, and block withdrawals under false tax or compliance pretexts.
Suspected verification and support pages request SIM verification codes or additional personal information.
Victim funds are routed through TRON (TRC-20) wallets and internal relays before being sent to centralized exchange deposit addresses; the article assesses these flows as suspected laundering.
Promotional articles, claimed regulatory credentials, and a fraudulent mobile app are used to create an appearance of legitimacy.
Defensive Notes: Monitor and block the identified scam domains and suspicious wallet addresses; continue monitoring for emerging domains and wallet activity associated with ZHGUI.
Issue alerts to financial-sector organizations and report relevant activity and wallet addresses to centralized exchanges.
Coordinate disruption efforts with platforms and law enforcement.
Treat the FinCEN MSB listing as self-submitted and unverified; the article states it is not proof of government approval.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`knightkron[.]com`	Mirror site identified as replicating ZHGUI scam interfaces.
DOMAIN	`sydmonet[.]com`	Mirror site identified as replicating ZHGUI scam interfaces.
DOMAIN	`zhgui[.]com`	ZHGUI scam mirror domain serving a cloned login portal.
DOMAIN	`zhgui[.]org`	Website presented as ZHGUI’s site in promotional material for the identified scam ecosystem.
DOMAIN	`zhguicx[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguihc[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguimj[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguioe[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguiqt[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguiqz[.]com`	Registration link associated with the ZHGUI investment scam funnel.
DOMAIN	`zhguiro[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguisp[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguitn[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguivx[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguiwd[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguiyv[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
DOMAIN	`zhguize[.]com`	Cloned ZHGUI scam login and investment portal identified as part of the mirror-domain infrastructure.
HOSTNAME	`rtqs[.]zhguibn[.]com`	ZHGUI-associated WebSocket host identified as serving simulated trading-dashboard data.
HOSTNAME	`rtqs[.]zhguiwe[.]com`	ZHGUI-associated WebSocket host identified as serving simulated trading-dashboard data.
URL	`hxxps[:]//1884145[.]udeskglobal[.]com/sim`	Connected SIM-verification page described as potentially used for fake verification or support and collection of identity data.
URL	`hxxps[:]//52[.]74[.]11[.]35/`	ZHGUI-associated end-user login page with Chinese-language error messages, identified as part of the suspected backend infrastructure.
URL	`hxxps[:]//52[.]77[.]125[.]17/home/login`	Suspected operator management-console login page associated with the ZHGUI scam infrastructure.
URL	`hxxps[:]//apps[.]apple[.]com/us/app/zhguige/id6747241718`	Specific App Store listing for the fraudulent ZHGUI GE trading app, which the article says was later removed.
URL	`hxxps[:]//doc[.]zhgui[.]com/ZHGUI-Whitepaper-EN[.]pdf`	ZHGUI-hosted whitepaper used to support the scam’s misleading claims of legitimacy.
URL	`hxxps[:]//udesk[.]zhgui[.]com/`	ZHGUI-associated support login page described as part of the scam’s identity and KYC-data collection infrastructure.