Guggenheim investment scam: €1.5 million stolen
Criminal wallet exposed – where victims sent crypto
They built a professional-looking fake site with fake metrics ("2.5 million clients", "$2 billion deposits") and a fake "Guggenheim TRADING APP". None of this exists. The real Guggenheim Investments has no trading app, no crypto, no WhatsApp groups. DO NOT TRUST OR SEND MONEY.
🚨 IDENTITY THEFT ALERT
- Passports, driver's licenses, ID cards - Scammers request "verification documents" and use them for identity fraud
- Bank statements & proof of address - Used to open fraudulent accounts in victims' names
- Selfies with ID - Victims tricked into sending "verification selfies" used for deepfake scams
- Phone numbers & emails - Sold on dark web to other criminal networks
- WhatsApp conversation history - Mined for personal information and contacts to target family members
NEVER send photos of your ID or documents to anyone on WhatsApp claiming to be from "Guggenheim". They steal your identity to commit more crimes.
Confirmed scam domains: vtmarketsblocjp.cc guggenheimfx.com guggenheimus.com (they frequently switch domains)
Why Gname? The criminals chose this Chinese registrar because they accept crypto payments and are based in China – same region as the scammers. Multiple abuse reports filed, but they keep registering new domains.
Real Guggenheim (legitimate): https://www.guggenheiminvestments.com/ – they do NOT use WhatsApp, Telegram, crypto, or trading apps.
✔ Verified victim losses: €1.5M+ (more across Europe,US,UK). The ring uses UK/US spoofed numbers, stolen logo, poor English, and refuses video calls. They are NOT legit.
🔥 SCAMMERS CAUGHT: REAL IP ADDRESSES EXPOSED
⚠️ THEY USE VPN BUT WE HAVE THEIR REAL CONNECTION DATA ⚠️
The scammers made a critical mistake: they connected to their admin panels without hiding their real IPs. Below are the actual IP addresses they used to access https://admin.guggenheimus.cc/admin/admin/login and https://admin.guggenheimfx.com/admin/admin/login. These IPs were logged in Madrid, Spain time.
📱 Device: Mobile · Safari/macOS
⏰ Time (Madrid): 2026-02-17 16:01
🔍 Status: Active tracking
📱 Device: Mobile · Safari/macOS
⏰ Time (Madrid): 2026-02-17 01:15
🔍 Status: Active tracking
📱 Device: Mobile · Safari/macOS
⏰ Time (Madrid): 2026-02-16 19:13
🔍 Status: PROBABLE REAL IP
📱 Device: Mobile · Safari/macOS
⏰ Time (Madrid): 2026-02-16 12:48
🔍 Status: PROBABLE REAL IP
🚨 CRITICAL: SCAMMERS' ADMIN PANEL EXPOSED
The criminals accessed their admin panels here:
- 🔗 https://admin.guggenheimus.cc/admin/admin/login
- 🔗 https://admin.guggenheimfx.com/admin/admin/login
THEY ENABLED 2-FACTOR AUTHENTICATION USING GOOGLE AUTHENTICATOR – this shows they are technically sophisticated but made a mistake by not hiding their IPs properly.
🖥️ ADMIN PANEL PREVIEW (layuiAdmin Chinese Template)
🇨🇳 REPORT TO CHINESE POLICE (INTERNET POLICE) 🇨🇳
These criminals are operating from China. You have the right to report them to Chinese authorities. The Chinese Internet Police (网警) take cybercrime seriously, especially when it damages China's international reputation.
Provide them with all the evidence: IP addresses, admin panel URLs, criminal wallet, and domain registrar information (Gname).
HOW TO REPORT: Go to www.cyberpolice.cn (English interface available). File a complaint with all evidence. Also report to Gname abuse: [email protected] (tell them you've reported to Chinese police).
🇪🇺 FOR EU VICTIMS: Your local police can request mutual legal assistance from China through Europol or Interpol. The IP evidence is solid.
📋 WHAT TO TELL YOUR LOCAL POLICE:
- "I have evidence of a Chinese organised crime ring operating fake Guggenheim investment sites"
- "Their real IPs are logged: 122.51.236.174 (China), 106.54.62.156 (China)"
- "They accessed admin panels at admin.guggenheimus.cc and admin.guggenheimfx.com"
- "The criminal wallet is 0x074BeDf3e848C26ddfE09edA7283A4fe388Be204 on Ethereum"
- "Domain registrar is Gname (China) – they accept crypto payments"
- "Police can request VPN provider logs to unmask the real IPs behind 103.196.9.78 and 49.51.243.95"
THIS IS ACTIONABLE EVIDENCE. Take it to your local police, FBI, or national cybercrime unit TODAY.
💀 HERE IS WHERE VICTIMS SENT MONEY – CRIMINAL WALLET
USDC (ERC-20) · funds split to obscure trail
🔍 View criminal wallet on Etherscan (USDC transactions) – see how they split stolen crypto.
📸 VICTIM PROOF: Transaction sent to criminal wallet
This is a real victim's transfer to the scam wallet. They sent USDC believing it was a Guggenheim investment. The money was immediately split into multiple wallets to avoid tracking.
🔍 CRITICAL EVIDENCE – CLICK IMAGES TO EXPAND
🖥️ 1. Fake trading platform guggenheimus.com / guggenheimfx.com
💬 2. WhatsApp / Telegram criminal contact +44 spoofed numbers
🏛️ 3. Guggenheim logo & name stolen trademark infringement
❗ SCAMMERS' TACTICS – DO NOT FALL
- They create fake groups on WhatsApp / Telegram promising "guaranteed 100% returns".
- Use of legitimate-looking domain names: currently guggenheimus.com, guggenheimfx.com, vtmarketsblocjp.cc – but they change frequently.
- They impersonate Guggenheim Investments, using the official logo and name without authorization. guggenheimus.com even invents fake metrics: "2.5 million clients", "$2 billion deposits".
- Victims are instructed to pay only in cryptocurrency (BTC, ETH, USDT) – the criminal wallet is 0x074BeDf3e848C26ddfE09edA7283A4fe388Be204.
- They refuse video calls, speak broken English, and use UK or US phone numbers to appear trustworthy.
- Funds are immediately split and obfuscated via multiple wallets – see Etherscan evidence linked above.
- The ring is believed to be based in China (some Nigerian cells也可能), but evidence points to Chinese organised mafia.
🚨 IF YOU SENT MONEY OR WANT TO HELP: ACT NOW
If you are a victim: Contact your bank, local cybercrime unit, and report to IC3 (FBI) or your national fraud agency. Unfortunately, crypto recovery is extremely difficult – but reporting helps track the network.
Report the scam domains to Google Safe Browsing – this will mark them as phishing and protect future victims. Even if domains change, reporting educates the blocklist.
Report all scam domains: guggenheimus.com, guggenheimfx.com, vtmarketsblocjp.cc. Also report any WhatsApp numbers (+44 spoofed) you have.
⚠️ GUGGENHEIM INVESTMENT SCAM – ORGANISED CHINESE FRAUD RING ⚠️
Do NOT send crypto or any funds to individuals or companies claiming to be "Guggenheim" on WhatsApp, Telegram, or via unsolicited agents. The real Guggenheim Investments does not deal in cryptocurrency, does not recruit on WhatsApp, and has no relation to these domains. The fraudulent domains currently tracked: guggenheimus.com, guggenheimfx.com, vtmarketsblocjp.cc. Losses exceed €1.5 million, with victims across Europe. The criminals split funds through multiple wallets to evade tracking. If you have already sent money, contact your bank and local cybercrime unit immediately. Warn others by sharing this article.
* Bookmark guggenheim‑is‑a‑scam.com for updates and new domains
📱 JOIN VICTIMS SUPPORT GROUP
Already affected or want more information? Join our WhatsApp community of victims and investigators tracking this fraud ring.
Join WhatsApp Group