WhatsAppFinancial InvestigationIllustrative composite example

Pig-Butchering Scam: From a WhatsApp Message to a Public Website and Wallet Trail

June 12, 2025
Example outcome

Fake platform's public infrastructure and the wallet trail documented; hosting abuse reports and fraud complaints prepared.

Illustrative composite example. This case file combines and alters details from several scenarios to show how a TraxIntel review is scoped, checked, and reported. Names, figures, platforms, and outcomes are representative; it does not describe a specific customer, it is not a testimonial, and it is not a promise of results.

The work described stays within public sources and customer-provided material, is reviewed by an analyst before delivery, and involves no contact with the people in scope. TraxIntel does not access private accounts or messages, does not recover deleted content, does not track anyone's live location, and does not guarantee identification.

Scenario

A retiree received an unexpected WhatsApp message that grew into months of friendly contact and eventually an invitation to "invest" through a trading website. The retiree deposited crypto repeatedly before discovering that withdrawals were impossible.

Review Approach

  1. Client material. The retiree's messages, deposit confirmations, and screenshots of the trading site were preserved.
  2. Website infrastructure. The site's domain was checked against public registration, hosting, and certificate-transparency records, and its page template was compared with scam sites listed in public warnings.
  3. Public-chain review. Deposits were followed from the transaction IDs in the retiree's wallet history.

What the Review Surfaced

  • The trading site used a template that matched several sites named in public regulator warnings.
  • The domain had been registered weeks before first contact and shared hosting with other lookalike trading domains.
  • Deposits consolidated into an address that had also received funds from many unrelated senders, which is consistent with a pooled scam wallet.

Limits of the Review

Infrastructure overlap suggests a shared operation but does not identify its operators. TraxIntel did not attempt to trace the phone numbers, and the review did not promise recovery.

Handoff

The retiree's family filed fraud complaints with the documented trail, and hosting-abuse reports were prepared for the providers serving the site.