h5.wxpostexxesoxm.buzz is a scam: the fake relationship and the disposable app

A note first: we are a law firm and we handle online fraud cases only. If you want our help, fill in the form at the bottom of this article.

We have already handled this case and we can help people who have fallen into the same trap. h5.wxpostexxesoxm.buzz is a scam, and before anything else one thing has to be said: the person who ended up inside it was not naive. He was courted for months by a person who did not exist, and that is not a defect of intelligence. It is a method, and h5.wxpostexxesoxm.buzz is its last step.

It was not a platform: it was a page

The first thing to understand is that h5.wxpostexxesoxm.buzz is not an investment site. It is a web application for a phone, and it says so in its own address.

The h5 prefix is the technical convention for publishing apps built to run inside a mobile browser. And the end of the address we were given, that `#/` after the slash, tells you it is a single page: there are no internal pages, no separate address for the balance, the history or the withdrawal. Everything happens inside one screen, which can be changed from one moment to the next.

h5.wxpostexxesoxm.buzz being a single page means two things, both unpleasant. The first is that nothing is left to find afterwards: no indexed page, no public history, no copy in the search engines' caches. The second is that the whole dashboard — the capital, the percentages, the profits — is a drawing the phone receives and displays. The h5.wxpostexxesoxm.buzz dashboard is not an account: it is a picture of an account.

The domain does not even have a website

We checked the technical data of h5.wxpostexxesoxm.buzz in November 2026, and there is one detail here worth more than many words.

The domain behind h5.wxpostexxesoxm.buzz was registered on 25 September 2026 through a Singapore registrar, with its last change on 30 September 2026. But the main domain has no website at all: it does not answer, there is no homepage, no "about us" page, no contact. Only the subdomain with the h5 prefix answers — the app.

It means there was nothing to check even if you had wanted to. Anyone who had tried typing the name without the prefix would not have found a badly made company: they would have found nothing. And there is no email configured on that domain either: no corporate address, anywhere.

A door left open

There is a mistake, though, and in these cases mistakes are the most useful things.

The name management of the h5.wxpostexxesoxm.buzz domain is handled by Cloudflare, which usually serves to hide the real server's address. But the app's subdomain does not pass through the filter: it points directly to an address belonging to a large American shared-hosting provider. In other words, the server behind the app is exposed.

Honesty is needed here too: on shared hosting that address, on its own, identifies nobody, because the same address hosts many different sites. But it is not the same as having nothing: the provider is identified, it has a registered office, an abuse-reporting service and logs. It is a party the judicial authority can ask who uploaded those files, and from where.

Berlin

The part of the h5.wxpostexxesoxm.buzz story you do not forget is a journey.

The injured party — a man who followed for months the instructions of a woman he had met online — travelled to Berlin to meet her. She was not there. She had not fallen ill, she had not missed her flight: she had never been there at all.

That is the point where these cases become something other than a financial fraud. The money, by then, was a detail. Eight thousand euro gone to h5.wxpostexxesoxm.buzz between June and October 2026, partly by transfers abroad and partly in cryptocurrency, to a company's accounts.

Shame is the real obstacle

We write this because it is the thing that most often stops us working: someone coming out of a romance fraud is ashamed, and is angrier with himself than with the people who deceived him. Many do not report it for that reason, and some do not even tell their family.

So let us set two things out plainly, without rhetoric.

The first: relationships built at a distance are industrial work, carried out by organised groups with written scripts, shifts and conversation manuals. This is not a person who fell in love badly. It is a team that applied a procedure to one individual.

The second: shame is not a legal fact. It does not go into the file. What goes into the file are the dates, the amounts, the messages and the movements. And while shame advises waiting, the law and the banks reason in days: the later you arrive, the less road is left.

After the fraud, the fake lawyer

As in almost every file of recent months, after the loss on h5.wxpostexxesoxm.buzz a second wave arrived: a fake lawyer came forward.

The same rule always applies, and we are glad to repeat it: a real lawyer can be verified in thirty seconds in the public roll kept by the national bar council, searching by surname, first name and local bar. Someone who is not there is not a lawyer. And no lawyer asks for a percentage of sums not yet recovered, nor for advances to a wallet.

Internal transfers are not a problem

One last technical point, because in the h5.wxpostexxesoxm.buzz file it caused difficulty and it happens constantly.

Many people, before sending money, move it between their own accounts — from a savings account to a current account, or from one bank to another. Then, when we ask for the payment records showing the recipient's IBAN, they only find movements to themselves and think they have nothing.

That is not so. An internal transfer lengthens the chain, it does not break it: the bank keeps every leg of the operation, and the last step — the one going outwards — exists and can be obtained. You ask for the full statement for the period and the record of the individual outgoing operation, specifying that you need the beneficiary's IBAN and account holder. It is a right, and the bank is obliged to keep that data for ten years.

The offence

What happens on h5.wxpostexxesoxm.buzz amounts to fraud under article 640 of the Italian criminal code, aggravated by the use of computer tools under the amendment that came into force in 2024, applicable to 2026 facts such as these.

But there is also impersonation under article 494, and it is the clearest case imaginable: an identity built from scratch, with photographs, a name, a history and an appointment in another city. That is not a backdrop to the fraud, it is a separate offence, and it must be charged separately.

Where the money passed through a company's accounts, the chapter of money laundering under article 648-bis opens, and that is the ground on which real work is done: a company has an account, an account has a bank, a bank has records.

And for euro transfers made after 9 October 2025, including the one in October 2026, the bank should be asked for the outcome of the now-compulsory verification of payee: if the name given did not match the holder of the IBAN, that warning was produced, and knowing whether it was shown changes what can be argued against the bank.

What to do now

Save the app while it still answers. Screenshots of the balance, the history, the refused withdrawal, and the full address with the h5 prefix. When h5.wxpostexxesoxm.buzz disappears, nothing else will be left.

Save the conversations in full, not in pieces: the voice notes too, the photographs too, and the days when money was not discussed. They are what proves the construction of the relationship, which is the heart of the deception.

Ask your bank for the full trail of every outgoing payment, internal transfers included: destination IBAN and account holder, receiving bank, country, date and time.

For the cryptocurrency part, retrieve the transaction identifiers from the exchange you used and the list of destination addresses. The exchange releases that data to its customer on request.

Declare the documents you handed over: identity card, tax code, IBAN, utility bills. An identity document and a utility bill are enough to open an account in your name.

Stop talking to them and pay for no fake recovery connected to h5.wxpostexxesoxm.buzz.

Similar cases we have handled

The h5.wxpostexxesoxm.buzz pattern repeats under different names:

• tkbiy.top: the person first, the platform afterwards
• mh6215.it: three domains, two case files, one account
• globalnbcfinance.com: the fake platform update
• eccfinvestigators.com: the fake fund-recovery investigators
• sharecreditsecuritieslimited.com: the clone of an authorised firm
• userportal.space: the fake blockchain certificate

A warning that concerns us directly

We are aware that someone is telephoning defrauded people using our firm's name. We never call on our own initiative, we do not telephone in the evening or at night, we do not use foreign numbers and we never ask for money by telephone. If you receive a call like that, hang up and write to us through the form on this site.

If this happened to you, write to us

If you invested on h5.wxpostexxesoxm.buzz, or on an address that only opened on your phone inside a private conversation, fill in the form at the bottom of this page. Give the dates, the amounts, how you paid and how long you had known the person who suggested it.

And if you are reading this feeling that you were stupid: you were not. Time was spent on you, and the time spent is precisely the expensive part of the fraud. We read every request and we answer.