Upon request of our client the TokenScope Team (https://tokenscope.com) investigated Gobon.VIP services, a scam investment project (the website was created on the 26th of February, 2022, currently is not operating). Our client states he got victimized by Gobon.VIP investment project as it was promoted as a profitable one. Our client was invited to participate by Laura in Facebook (Laura, WhatsApp + (880)1831-615233, Telegram - @love_12135289).
The investment project implied depositing of funds at the 20% rate, supposedly for the purchase of goods at the Amazon website with receiving commissions from them further on.
Our client transferred 1 600 USDT with 5 transactions from his address on the Binance exchange to the address specified by a representative of Gobon.VIP in the TRON network: TTaDvTfQQQKrZZZXB7P4TVX6CgyGHeE63weU. After the transaction was completed the scam project representatives stopped to respond, the website also stopped working. According to the client, he received one payment to his wallet TEgjpXBnrxG58BAkiGBPt7DMDTovvneTvk in the amount of 144.4 USDT.
Analysis of transactions of the address TEgjpXBnrxG58BAkiGBPt7DMDTovvneTvk revealed the information about one incoming transaction on the 26th of March, 2022 from the address TLTggUAJtHvwEEfnfegRk5vB2GEWdB7Rk1 on the amount of 144.4 USDT, the indicated funds are currently stored on the address.
Examination of the TTaDvTfQQQKrZZZBX7P4TVX6CgyGHeE63weU address shows that:
- It was created on the 20th of March, 2022;
- the current balance is 1 016 USDT;
- 520 transactions were made on the address during 8 days.
The high activity of the address allows us to make a reasonable assumption that it belongs to a cryptoservice or an exchanger. TTaDvTfQQQKrZZZBX7P4TVX6CgyGHeE63weU address was replenished from Binance TV6MuMXfmLbBqPZvBHdHwFsDnQeVfnmiuSi, TYASr5UV6HEcXatwdFQfmLVUqQQQMUxHLS as well as from cold wallet TJDENsfBJs4RFETt1X1W8wMDc8M5XnJhCe (mentioned in the list of richest wallets, with the current balance of $125 690 845).
Withdrawals from TTaDvTfQQQKrZZZBX7P4TVX6CgyGHeE63weU were conducted to the following addresses:
-
TLTggUAAJtHvwEEfnffegRk5vB2GEWdB7Rk1 - the main operational address of the Gobon.VIP scam project, the current balance of it is about $2 000, the number and frequency of transactions indicate that this address belongs to an exchanger or an exchange. The main funds are withdrawn from the specified address to the following addresses: TUPw7pXYargJKKiUZWUbgatrqxFwiuy3FF TX6SEeUiSYeyVtrHoEiZmwHwCdxSHpaF1m TH7wruCoNKVH2PJDEMz88L8Kkda49DTkpw TGWsB1m38DWsz8w2VTVzN6z6nyU8k92zD (current balance is $168 000). Tracking the withdrawals from these addresses through the transaction chain, it was found that the withdrawal was made through a hot wallet on the exchange OKEx TM1zzNDZD2DPASbKcgdgVoTYhfmYgtfwx9R;
-
TAQyxNqeyzc9StDcsQKMKZjrEsVvDFqpbC address with current balance of about $5 000, from whitch funds were mostly transferred to the address TJK612JGNf27m8Z3KNx2XucrQn6WfVM2fM (current balance is $93 000, probably a cold storage address), and to the address TLTggUAJtHvwEEfnfegRk5vB2GEWdB7Rk1.
-
TBWCvEhFAzeXbbcaX4NHdNqJwTzAriDNxD (one withdrawal transaction was made on the amount of 300 000 USDT). After tracing the withdrawal from the address through a chain of transactions, it was found that the withdrawal was made through a hot wallet on the Binance exchange TV6MuMXfmLbbqBqPZvBHdwFsDnQeVfnmiuSi.
In addition, from the correspondence between our client and a representative of the scam project Gobon.VIP it was found out that there was another address belonged to the scam project: TCMNYqnoKmAxZgzCfLw1RrRdhtJaxZibaP. Withdrawal from which was also carried out to addresses: TAQyxNqeyzc9StDcsQKMKZjrEsVvDFqpbC and TLTggUAJtHvwEEfnffRegk5vB2GEWdB7Rk1 (specified earlier in the article).
While gathering information about the Gobon.VIP scam project we received information about another user from Turkey who also invested $62 000 in this project and received nothing in return Gobon.vip 500 Bin TL Bankalara Borçlandım - Şikayetvar (sikayetvar.com), from a video that was filmed by the second investor Gobon.VIP SCAM - DOLANDIRICILIK - FRAUD 500.000 tl borçlandım 62.000 usd dolandırıldım - YouTube we were able to find out previously unknown address for funds depositing: TMY5a6TNH3Ejat1Lhg2zKGUx24b7aPr6Dp.
Examination of the address TMY5a6TNH3Ejat1Lhg2zKGUx24b7aPr6Dp revealed that:
- it was created on the 17th of November, 2021;
- current balance is 10 239 USDT;
- the number of transactions of the address is 2 685.
Further examination of the address's outgoing transactions revealed that funds were withdrawn mostly to the following addresses: TLTggUAJtHvwEEfnffegRk5vB2GEWdB7Rk1 - main transaction address of Gobon.VIP; TUPw7pXYargJKKiUZWUbgatrqxFwiuy3FF (listed in the article earlier); TX6SEeUiSYeyVtrHoEiZmwHwCdxSHpaF1m (listed in the article earlier); TPK4NnXqPg3B2UG5feYVdfGpwHLeeXf7wK - the current balance of the address is $5 000, probably is a cold storage wallet.
Thus, we can conclude that the funds of Gobon.VIP scam investment project were collected on the wallets TTaDvTfQQKrZZZXB7P4TVX6CgyGHeE63weU, TCMNYqnoKmAxZgzCfLw1RrRdhtJaxZibaP and TMY5a6TNH3Ejat1Lhg2zKGUx24b7aPr6Dp, from which were mainly sent to the operating address of the project - TLTggUAJtHvwEEfnffegRk5vB2GEWdB7Rk1 (some payments to clients were also conducted from it). Further withdrawn transactions were carried out thought the chain of addresses, to the hot wallets on the exchange OKEx and Binance, some funds are stored on the cold wallets.