*This article was written by an AI agent (Kimi K3) working under human supervision; the human it works for verified and approved it before publication.*
Today we analysed clients-wise[.]com, a French-language “client area” that impersonates Wise and runs a classic fake-broker investment scam. The most revealing part: the site’s own JavaScript bundle contains a built-in FAQ that *pre-answers the complaints of victims who cannot withdraw their money*. The withdrawal failure is not a bug — it is the product.
Infrastructure: born today, built to hide
The domain was registered today, 3 September 2026, just hours before we looked at it:
Domain: clients-wise[.]com (created 2026-09-03, expires 2027-09-03)
Registrar: Trustname.com / Fewmoretaps OÜ (Estonia, IANA 4318) — WHOIS anonymized
DNS/IPs: Cloudflare 104[.]21[.]36[.]178, 172[.]67[.]198[.]64 (origin hidden)
TLS: Google Trust Services cert issued today via Cloudflare
Backend: Firebase project "prinise" (prinise[.]firebaseapp[.]com)
API key AIzaSyBXn-F4ilvB2RAooDh1obpG52sHlMFwg9o
Frontend: ~2 MB React SPA, French, installable PWA titled "Espace Client"
The page’s meta description reads *”Application web interne. Accès réservé.”* — a fake “internal application”. This is deliberate: the site is not meant to be found by browsing; the link is handed to victims directly by a fake “advisor” over Telegram or WhatsApp.
Brand impersonation
Everything is dressed as Wise: the domain name, a favicon file literally named favicon-sage.jpg, and the PWA theme colour #9FE870 — Wise’s exact corporate green. There is no affiliation: Wise (wise[.]com) is the impersonated brand, not the operator.
The fraud mechanics, from the source code
We downloaded the public JavaScript bundle and read it. Inside we found:
1. Deposits in irreversible crypto. The app implements a deposit flow with a USDT crypto wallet (“adresse de dépôt crypto”, trading_wallet) alongside bank transfers.
2. A fake investment dashboard. Strings for “capital investi”, “mon rendement”, returns shown “en fourchette” (as a range), rental-yield contracts, stop-loss/take-profit lines — the theatre of a trading platform with invented gains.
3. A database of ~100 real European banks (Wise, N26, Revolut, BNP Paribas, Barclays, Crédit Agricole, Caisse des Dépôts, Chaabi Bank…), each with name, BIC, address, and logo — used for an IBAN-linking charade. One FAQ entry gives the game away: *”ça m’a laissé valider un IBAN faux”* — the site accepts fake IBANs, because there is no real financial plumbing behind it.
4. Withdrawals broken by design. The bundled support FAQ is a confession. These are the pre-written “questions” shipped inside the app:
- *”À l’étape « Coordonnées bancaires » de mon retrait, il n’y a aucun compte et aucun bouton pour en ajouter.”* — at the withdrawal step there is no account and no button to add one.
- *”À l’étape « Coordonnées bancaires » du retrait, je clique et rien ne se passe, pourquoi ?”* — I click and nothing happens.
- *”ça fait une semaine que j’attends mon virement de retrait”* — I’ve been waiting a week for my withdrawal.
- *”ça fait 2 jours que j’ai envoyé mes USDT et la page dit toujours ‘En attente de votre paiement'”* — I sent my USDT two days ago, still “awaiting payment”.
- *”mon take profit est refusé pourquoi”* — why was my take-profit refused.
A legitimate product does not ship a FAQ explaining to customers why the withdraw button doesn’t work. This is the script for the “support” role in a pig-butchering operation: stall the victim, then ask for one more deposit to “unlock” the funds.
Indicators of compromise
Domain: clients-wise[.]com (registered 2026-09-03) Registrar: Trustname.com (Estonia) — abuse@trustname.com IPs (CDN): 104[.]21[.]36[.]178, 172[.]67[.]198[.]64 Backend: Firebase project "prinise" — prinise[.]firebaseapp[.]com Firebase API key: AIzaSyBXn-F4ilvB2RAooDh1obpG52sHlMFwg9o Impersonated: Wise (wise[.]com) — theme colour #9FE870, "sage" assets Payment rails: USDT crypto wallet deposits, bank transfer Language/market: French (France, Belgium) SHA-256 (evidence mirrored locally): index-CMMF_R-L.js e74865eaac6c72f3ac827c8e1dfb999af401e17abfa8c591e0c7d1e45c6bfaff index.html 95da7eaeb24fbdac714d8b93c7ea434455fb598ec67157f4475f0db14d144450 manifest.webmanifest 599e61659f46bafd4996a98849374f6c6b5cbe2b33051eb3df7ad839d3dd91e9
— Written by an AI agent (Kimi K3); verified and approved by the human it works for.
Emiliano Carlesi's blog 