Inside the Network of IT Shell Platforms Enabling Illicit Transactions
In collaboration with law enforcement intelligence units and investigative media contacts, we reveal the existence of a coordinated network of digital shell companies, operating under the guise of IT service providers but in fact acting as covers for money laundering and transaction masking operations.
Entities under scrutiny include:
- dataherosolutions
- csrxplate
- greathub
- techglows
- infodsys
Each appears to be a standard digital agency or SaaS company on the surface. But detailed forensic analysis of their web infrastructure, transaction metadata, and domain behavior tells a far more disturbing story.
🧩 How the Scheme Works
These platforms are not designed to build apps, host websites, or consult on tech innovation. Their actual function is to:
- Receive “consulting payments” that are in fact redirected casino winnings, crypto swaps, or grey-market e-commerce profits.
- Break financial traceability through multi-hop redirections and split withdrawals via third-party wallets.
- Act as false invoice endpoints in fake B2B arrangements, typically supported by unverifiable “contract work.”
Web scans and transactional analysis show near-zero legitimate commercial activity. Their frontend websites are often pre-designed templates, with empty blog sections, broken contact forms, and non-existent portfolios.
🛰 Connection to JazzCash Clone Networks
While these platforms do not publicly list operations in Pakistan, we uncovered several critical leads suggesting integration with phishing and laundering infrastructures operating in the region.
- Telegram logs reviewed by cybercrime task forces include mentions of dataherosolutions and csrxplate domains embedded in phishing kits impersonating JazzCash.
- Pakistani cybersecurity firms monitoring fake wallet APKs and redirect pages identified techglows and infodsys as relay domains in fraud workflows.
- DNS behavior and TLS certificates from some of these platforms match patterns from fraudulent payment forms used to capture user data and spoof real PSPs.
These indicators place the shell platforms squarely within the laundering chain, if not geographically then technically and operationally.
🧾 Legal & Intelligence Sources Confirm Risk Flags
According to confidential reports obtained through law enforcement intelligence sharing platforms, several of the above domains have been flagged in active AML (Anti-Money Laundering) and CFT (Countering the Financing of Terrorism) investigations.
Payment service providers across Asia and the Gulf region were alerted to unusual transaction volumes and synthetic KYC data flowing through bank accounts linked to “tech consultancy” invoices issued by shell companies bearing these names.
🔒 Why This Matters
These are not isolated websites. They represent a coordinated laundering infrastructure capable of operating cross-border, bypassing fintech controls, and cloaking illicit money under the banner of digital innovation.
In a financial world increasingly dependent on automated compliance, the ability to mimic legitimate B2B IT activity makes these platforms particularly dangerous and hard to detect.
📌 Recommendations for Authorities and Banks
- Flag inbound/outbound transactions involving these domains or their aliases.
- Require substantiated business records and project documentation for any IT or SaaS invoice from unknown vendors.
- Increase scrutiny on freelancer-type B2B transfers that originate in high-risk geographies but route through tech consultancies.
🔍 Final Note
This report is the result of joint research by investigative journalists, intelligence analysts, and fintech monitors. It aims to provide actionable visibility into a hidden financial layer powering global digital laundering.
We will continue tracking the movements and infrastructure changes of these domains and publish follow-up bulletins as new data is confirmed.