The firm has already handled this case: a fake trading platform whose very name announced remote control of the victim's computer. The domain checks, what to do immediately afterwards and why the complaint already filed is not enough.
Preliminary note: we are a law firm and we deal exclusively with online fraud and the unauthorised provision of financial services. This article arises from a real case handled by the firm and is published in anonymised form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain-name registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your situation using the form at the bottom of this page.
There is one detail in this case that usually escapes everyone and that in fact says almost everything: the name of the domain. The injured party paid twenty-one thousand euros into a trading platform called webtrader.rdpsystem.pro. RDP, in computing jargon, is the abbreviation for the remote desktop protocol. The name of the fake platform announced, to anyone able to read it, exactly what was going to happen: someone was going to take control of their computer.
And that is what happened. webtrader.rdpsystem.pro is a scam, the firm has already handled this case, and this article explains how to recognise it, why the remote-control software changes the nature of the problem, and what must be done immediately afterwards.
Why webtrader.rdpsystem.pro is a scam: the domain speaks
Let us start with the objective checks, the ones anyone can repeat.
The domain on which webtrader.rdpsystem.pro runs was registered on 31 May 2026, expiring on 31 May 2027: a one-year term, the minimum term, the term of someone with no intention of still being there the following year. The registrar of record is a Hong Kong company. Name resolution is handled by a pair of servers belonging to a well-known content delivery network: a very common and perfectly lawful service, which proves nothing on its own, but which has the practical effect of concealing where the site is actually hosted.
Then comes the figure that really counts. The main domain has no website at all: typing it leads nowhere. The only address that answers is the webtrader.rdpsystem.pro subdomain, the panel where the injured party was shown the numbers. There is no homepage, no corporate page, no legal section.
Nor is there any mail: the domain has no mail records, which means nothing can be written to that address. A financial intermediary with no e-mail address on its own domain is a contradiction in terms.
Add the extension. The .pro suffix was created for qualified professionals, and it is precisely that aura of professionalism that is bought for a few euros along with the name.
And add the date. The injured party's story begins in May 2026 and closes in June 2026: the domain is registered on 31 May 2026, that is, it is born together with the fraud. This is not a platform that existed before and then broke down: it is infrastructure created for that season of payments and then left to die.
Finally, the proof that outweighs all the others: webtrader.rdpsystem.pro has no authorisation, no VAT number, no company name, no reference to any intermediary entered in a supervisory register. There is no company to name, because there never was one.
Remote control: the point that changes everything
In the webtrader.rdpsystem.pro case the injured party was guided into installing remote-assistance software on their computer, of the kind commonly used by technical support services. The stated purpose was to "help them operate".
That is the moment when the fraud stops being only a fraud.
Whoever obtains remote control of a computer sees the screen, moves the mouse, opens the folders, reads the documents that are open, can get into the e-mail if the mailbox is already open in the browser, can see the saved credentials, can open online banking if the session is active, can copy files. The victim need type nothing: everything happens before their eyes, on their connection and from their network address.
For this reason, in cases like webtrader.rdpsystem.pro, the first thing to do is not to think about the money: it is to secure the computer.
In practice that means uninstalling the remote-assistance software; revoking any permanent access that was configured; changing passwords from another device, not from the compromised one, starting with the mailbox, which is the key to everything else; enabling two-step verification on the mailbox and on online banking; checking that no automatic forwarding rules to unknown addresses have been created in the mailbox, because that is the quietest way to go on reading someone's correspondence after contact has ended; checking the credentials saved in the browser; and reporting the matter to the bank, asking for attention to anomalous transactions.
On this point, anyone who has also handed over personal documents will find useful what we have written about m.hashvalueks.com, where we deal with the express disavowal of documents handed over.
The thousand euros that "proved" it worked
In the webtrader.rdpsystem.pro sequence there was a moment when the injured party actually received money: about a thousand euros, credited to prove that the platform paid out.
That payment is not a profit. It is the fraudster's investment, and it is the most carefully designed step in the whole scheme: a small sum, returned early, which turns suspicion into trust and opens the way to the large payments. Someone who pays a thousand euros in order to collect twenty-one thousand is not getting their sums wrong: they are getting them exactly right.
The other side arrives at the end. On webtrader.rdpsystem.pro, when the injured party asked how to withdraw, the tone changed: haste, evasiveness, answers that do not answer. That is the signal that the cycle has closed.
The account "in your name" is a drawing
In the webtrader.rdpsystem.pro panel the injured party appeared as the holder of two positions: their own and a small one in their partner's name, on which automatic credits appeared.
It is worth saying this plainly, because it is the point on which many people deceive themselves, including in front of panels identical to that of webtrader.rdpsystem.pro: those accounts do not exist. The panel is not a statement of account, it is a web page drawn by whoever built it, where the figures are written by hand and go up when they need to go up. The only real money in the whole affair is the money that left the injured party's account.
The presence of a position in the partner's name has, however, a serious practical consequence: it means that her data too ended up in the organisation's hands, and that her own standing as an injured party, and a written disavowal for her as well, must be considered.
The complaint has been filed, but on its own it is not enough
In the webtrader.rdpsystem.pro case the injured party had already filed a criminal complaint with a police station, also handing over a storage device with the conversations. That is a positive fact and must be said.
The problem is another: a complaint that describes the transfers and attaches the chats does not contain the applications that make things move. In a case like webtrader.rdpsystem.pro the document also needs an application for the preventive seizure of the sums under Article 321 of the Italian Code of Criminal Procedure, because until someone makes it no one can grant it; the complete legal classification with the aggravating circumstances, because that changes how the case may be prosecuted and the attention the file receives; the request for information on the registration of the notice of the offence under Article 335; and the request for notice in the event of a request to shelve the case under Article 408(2), which is the only way to be able to oppose it instead of discovering the closure after the event.
There is then a point specific to this case. The transfers are partly Italian and partly directed abroad, to accounts in France and Bulgaria. These are European Union countries, and that is an advantage: the instrument for obtaining banking documentation abroad is the European Investigation Order (in Italy, Legislative Decree 108/2017), which works on application by the prosecuting authority. But it must be requested, and requested specifying precisely which accounts and which transactions.
An existing complaint is not thrown away: it is supplemented. We have written about this in relation to a.holdhands.vip as well.
The legal framework
The webtrader.rdpsystem.pro facts date from 2026, and are therefore subsequent to Law 90/2024: Article 640(2-ter) of the Italian Criminal Code applies, which aggravates fraud committed remotely by means of computer tools capable of obstructing the identification of the perpetrator.
The aggravating circumstances of diminished capacity to defend oneself (Article 61(5)), given the online context and the relationship of trust built over time, and of particularly serious financial loss (Article 61(7)) also apply. Repeated payments over a period of weeks amount to a continuing offence (Article 81(2)).
Anyone presenting themselves as a financial promoter or adviser without being one is liable for the unlawful exercise of a profession (Article 348) and for impersonation (Article 494); offering investment services without authorisation amounts to an offence under Article 166 of the Italian Consolidated Law on Finance, which is prosecuted ex officio. The subsequent movement of the sums is relevant as money laundering (Article 648-bis).
The computer-related aspect deserves separate assessment, and it is the distinctive feature of webtrader.rdpsystem.pro. Consent to remote access was obtained by deception and for a stated purpose different from the real one: the Italian Supreme Court treats access to, or remaining within, a system in breach of the conditions set by the holder as criminally relevant under Article 615-ter. It is an aspect to be verified case by case, and it must be flagged in the complaint so that the authorities can assess it.
The aggravating circumstances of the second paragraph of Article 640 and Article 166 of the Consolidated Law on Finance make the matter prosecutable ex officio.
What to secure immediately
Anyone who has paid money to webtrader.rdpsystem.pro should obtain: the complete bank advices for all transfers, with destination IBAN, beneficiary bank, value date and reference; screenshots of the panel and of the figures displayed, if any remain, because the subdomain can disappear overnight; the native export of the conversations, done with the application's own function and not with photographs of the screen; the name and version of the remote-control software installed, with the dates of the sessions, which the software itself often keeps in its own logs; the list of personal documents handed over, with dates and channels; and the complete banking documentation in official form, invoking Article 119(4) of the Italian Consolidated Banking Act, which gives the right to a copy of the documentation of transactions over the last ten years.
And the warning that always applies: anyone who contacts you promising to recover the sums in exchange for an advance payment is the second scam, built on the lists of the victims of the first. We have written about this in relation to ecommbx.online and hmtreasurygovuk.com, where fake authorities demand money from people who have already been defrauded.
Similar cases already handled by the firm
Anyone who has come across webtrader.rdpsystem.pro will also find useful our analysis of sepa.finance, where an identity document sent by the self-styled operator turns out to be forged, and that of sd3257.it, where we explain what a technical datum about a domain does and does not prove.
If you paid money to webtrader.rdpsystem.pro: what to do now
The picture is this. webtrader.rdpsystem.pro is a scam: an active subdomain on a name registered on 31 May 2026 for a single year, with no main site, no mail, no company, no authorisation, whose very name announces remote control of the victim's computer.
If it happened to you with webtrader.rdpsystem.pro or with a platform built the same way, the order of things is this: first secure the computer and the mailbox, then gather the bank advices and the conversations in their original form, then supplement the complaint with the applications that are missing. And do not pay anyone who promises to recover the money.
The firm has already handled this case. You can submit your situation for a preliminary assessment.
If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
