In ~72 hours of observable activity, this single current account moved sums consistent with a syndicated mule operation: hundreds of small inbound NEFTs, fan-out RTGS to a recurring shortlist of beneficiaries, and a session footprint spanning six countries, residential-proxy networks, Cloudflare WARP, a DigitalOcean VPS, and a server-side Java bot calling the same internet-banking endpoint every 30 minutes.
MOHAMMED) authenticated from 6 countries — IN, HK, ID, MY, SG, FR.Java/1.8.0_471 — server-side HTTP client, not a human browser. Fires at :16 and :46 past the hour.The technical signature (Java bot + DC VPS + residential proxies + impossible travel) combined with the financial signature (low-balance pass-through, fan-in / fan-out, repeating ₹100–₹3,680 NEFT bouncebacks, recurring shadow-beneficiaries) is a textbook Money-Laundering-as-a-Service operation linked to overseas (PRC-linked) illegal-payment-gateway clusters seen across HK / MY / ID infrastructure.
The "merchant" is a façade. The account is the product; it is being rented out to multiple upstream PG operators, each pushing transactions through it on a schedule.
Each flag below is independently visible from RBL's own log + statement data. Together they form an unambiguous signature.
Java/1.8.0_471 — a JVM HTTP client, never a real human browser. These originated from a single internal-looking IP 10.192.8.136 and only execute the Process the login fields event.ESYEC0479.MOHAMMED seen from India · Hong Kong · Indonesia · Malaysia · Singapore · France within the same week. Foreign sessions ≈ 79 events (9% of total).203.175.14.44 / .45 (GOALNOW NETWORK, HK), 119.237.255.203 (HKT, HK) and 103.171.247.134 (GTPL, Kolkata) as known residential-proxy exit nodes branded IPCola & Croxy.104.28.x.x (Cloudflare WARP — VPN, 113 events) and 68.183.91.168 (DigitalOcean VPS, Bāshettihalli, 316 events) account together for ≈ 50% of activity. No legitimate small-LLP customer signs into their bank from a Linux VPS.CIB/RTN/…/NEFT/IncorrectAccountNumber reversals at repeating amounts: ₹100, ₹110, ₹143, ₹153, ₹200, ₹287, ₹504, ₹1,070, ₹3,680. Identical amounts recur dozens of times the same day.ADARSH TRADERS, LUMINATE DIGITAL MARKETING, LUCKY ONLINE SERVICES, AADI ENGINEERING, REBHEEM TRADING, SANGITA W/O VIJENDRA, SWAPNIL RAMDHAN TAWADE, SHIKHAR SRIVASTAVA, BHAMRAI GLOBAL TEXTILE, EKLAVYA INFRACON.CHOUDHARYABHINANDAN1@Y, RASWATH2007-2@OKICICI, 9911054683@YBL, 9842271920@PTYES into a current account of an LLP claiming to be an e-shopper. No invoice trail, no merchant VPA.10.192.8.136, and within 30–120 seconds the DigitalOcean Chrome session at 68.183.91.168 uploads a payment file / submits a transaction. Cross-correlation count of such pairs in May 11–13 alone: 30+.All sessions below are tied to a single internet-banking user (ESYEC0479.MOHAMMED) on a single account, between 28 Apr and 15 May 2026.
| IP / Identifier | Country · City | ASN / Provider | Risk Tags | Events | Role in the operation |
|---|---|---|---|---|---|
| 10.192.8.136 | — (RFC-1918 internal) | — (not seen on Internet) | BOT | 368 | Java/1.8 cron-bot. Login warmer firing at :16 and :46 past the hour. |
| 68.183.91.168 | India · Bāshettihalli | AS14061 DigitalOcean LLC | DC/VPS | 316 | Primary operator workstation — does file uploads, txn submissions, beneficiary edits. |
| 104.28.245.127 | Indonesia · Jakarta | AS13335 Cloudflare WARP | VPN/RELAY | 61 | Operator using mobile WARP from Jakarta — drives sessions interleaved with the bot. |
| 104.28.225.171 | India · Chennai (anycast) | AS13335 Cloudflare WARP | VPN/RELAY | 46 | WARP exit. Used continuously alongside the Java bot on 11-May. |
| 111.92.122.63 / 111.92.126.221 | India · Kanayannur (Kerala) | AS17465 Asianet Broadband | ISP | 14 | Likely the genuine account-holder's home broadband — used only on a few login attempts. |
| 203.175.14.44 / .45 | Hong Kong · Tung Chung | AS152320 GOALNOW NETWORK | RES-PROXY IPCola | 8 | Paid residential-proxy exit (IPCola) sold to fraud operators. PRC-linked infra. |
| 2401:4900:8fdc:c5da::/64 | India · Kanayannur | AS24560 Airtel Telemedia | ISP-v6 | 8 | Probable real Airtel home line of the account holder. |
| 104.28.225.172 / 104.28.193.171 / 104.28.216.30 | India · Chennai / France · Rouen | AS13335 Cloudflare WARP | VPN/RELAY | 10 | Additional WARP exits — France appearance shows the operator hops geos at will. |
| 103.171.247.134 | India · Kolkata | AS135872 GTPL KCBPL | RES-PROXY Croxy | 5 | Croxy residential-proxy exit — same operator family as IPCola. |
| 211.24.79.14 | Malaysia · Johor Bahru | AS9930 TTNET (Time) | ISP-foreign | 4 | Foreign retail broadband — first session of the campaign on 07-May. |
| 117.242.74.245 | India · Malappuram (Kerala) | AS9829 BSNL | ISP | 3 | BSNL line in Malappuram — likely the account-holder's secondary line. |
| 14.194.240.174 | India · Delhi | AS45820 Tata Tele | ISP | 1 | One-off — geographic outlier vs declared Tirur address. |
| 119.237.255.203 | Hong Kong | AS4760 HKT (Netvigator) | RES-PROXY IPCola | 1 | Residential-proxy exit — 25% days-seen with IPCola in last month. |
| 91.199.84.208 | Hong Kong | AS199524 G-Core Labs | HOSTING | 1 | G-Core HK datacentre — opaque cloud egress. |
| 163.128.98.59 | Singapore | AS154562 CYBERJET PTE LTD | HOSTING | 1 | SG hosting provider — used once for a foreign credential-validation event. |
Sampled window from 13 May 2026, 09:00–10:30 IST showing how the server-side Java login (10.x) interleaves with file-upload and txn-submit events from the DigitalOcean droplet (68.183.91.168).
--- 13 May 2026 --- 09:00:52 68.183.91.168 Chrome/148 Mac OS X validates user credentials on first auth screen 09:16:00 10.192.8.136 Java/1.8 Process the login fields ← bot warmup 09:20:57 68.183.91.168 Chrome/148 Mac OS X Attaches a file and validates the form fields 09:21:08 68.183.91.168 Chrome/148 Mac OS X Uploads a file and validates the mandatory fields 09:33:36 68.183.91.168 Chrome/148 Mac OS X validates user credentials on first auth screen 09:46:00 10.192.8.136 Java/1.8 Process the login fields ← bot warmup (T+30 min) 09:46:05 10.192.8.136 Java/1.8 Process the login fields 09:53:38 68.183.91.168 Chrome/148 Mac OS X Attaches a file and validates the form fields 09:55:39 68.183.91.168 Chrome/148 Mac OS X Attaches a file and validates the form fields 09:55:50 68.183.91.168 Chrome/148 Mac OS X Uploads a file and validates the mandatory fields 10:07:32 68.183.91.168 Chrome/148 Mac OS X validates user credentials on first auth screen 10:10:35 68.183.91.168 Chrome/148 Mac OS X Attaches a file and validates the form fields 10:10:51 68.183.91.168 Chrome/148 Mac OS X Uploads a file and validates the mandatory fields 10:16:00 10.192.8.136 Java/1.8 Process the login fields × 7 in 17 seconds 10:29:31 68.183.91.168 Chrome/148 Mac OS X Attaches a file and validates the form fields 10:29:52 68.183.91.168 Chrome/148 Mac OS X Uploads a file and validates the mandatory fields
The technical signature is mirrored on the money side. Three sub-signatures repeat across both statement days.
| Signature | What to look for | Why it indicates a Chinese-PG mule |
|---|---|---|
| S1 · Bulk-NEFT bounceback | 50+ CIB/RTN/.../NEFT/IncorrectAccountNumber in one day, at repeating denominations: ₹100, ₹110, ₹143, ₹153, ₹200, ₹287, ₹504, ₹890, ₹1,070, ₹3,680. |
Mass payouts to fake/stale beneficiary lists — the lists are generated programmatically by the upstream PG. A real business does not bounce ₹110 to 40 different accounts in one afternoon. |
| S2 · "Auto Reversal" loops | BU : 2234xxx Auto Reversal entries at the same denominations as the failed NEFTs. The system credits the funds back the same day. |
Closed-loop bookkeeping — failed payout → re-pooled → re-attempted to a fresh mule. Each cycle generates an audit-trail of noise that conceals the genuine layering legs. |
| S3 · RTGS fan-out to repeat names | 2–10 RTGS debits per day to the same shortlist: ADARSH TRADERS, LUMINATE DIGITAL MARKETING, AADI ENGINEERING, LUCKY ONLINE SERVICES, REBHEEM TRADING, SANGITA W/O VIJENDRA, SHIKHAR SRIVASTAVA, BHAMRAI GLOBAL TEXTILE, EKLAVYA INFRACON, OVIYASREE AGENCIES, KING WORLD FURNITURES, AVIARA ENTERPRISE. | These are the next-hop mule accounts. The same set is rotated daily, with one or two new additions per week to defeat static-rule monitoring. |
| S4 · Personal-UPI inflows into a current account | UPI deposits from VPAs like CHOUDHARYABHINANDAN1@Y, RASWATH2007-2@OKICICI, 9911054683@YBL — personal handles, no merchant VPA, no QR-merchant flag. |
Funnel from low-tier victim-facing mules (online "task" scams, gaming top-ups, OTP-coerced UPIs) into the corporate pool. |
| S5 · Pass-through balance signature | Daily turnover > ₹1 crore but closing balance always < ₹1 lakh (10-May closing ₹1,556; 11-May closing ₹64,361; 13-May closing ₹70,227). Sanction limit ₹0 / drawing power ₹0. | The account never accumulates working capital. It is purely a corridor. |
| S6 · IMPS round-tripping with cluster names | IMPS from QWERYCRAFT ANALYTICAL, KING WORLD FURNITURES, OVIYASREE AGENCIES, STEEL CRAFT KMB, CORNERS CAFE IIB, MUKUL CYCLE STORE — same names recur as both senders and receivers across days. |
Same-syndicate mule-to-mule transfers. A node simultaneously deposits and withdraws to the same counterparty within hours. |
These rules are computable from the data RBL already collects (login logs + IP enrichment + statement events). Each is written so it can sit on a Flink / KSQL / Drools stream and fire in real time before the first crore moves.
auth_log · Window: real-timeMost of the above rules are reactive. The mule is already operational. The cheaper win is to refuse to open the account, or to ring-fence it for a probationary period.
| Stage | Control | Trigger | Outcome if fired |
|---|---|---|---|
| Onboarding | LLP-name n-gram screen | Names containing generic e-commerce tokens (shopee, shoppe, ecart, ezshop, onlinemart, digital, traders, enterprise, agencies, holdings) combined with a rural pincode and a sub-1-year-old LLP registration. |
Enhanced Due Diligence + director video-KYC + 90-day probation with ₹5L daily debit cap. |
| Onboarding | IP-at-application screen | Application or first-login from VPN/Cloudflare WARP / residential-proxy / hosting ASN. | Block account activation until in-branch verification. |
| Day 1 – 30 | Velocity ramp | Any inbound day > ₹50K in the first 30 days for a non-priority current account without sanctioned limit. | Soft-freeze outbound until purpose-of-funds declaration and 1-st invoice upload. |
| Day 1 – 90 | Counterparty whitelist | RTGS/NEFT to a non-whitelisted beneficiary in the first 90 days. | Hold + cooling period + OTP + branch call-back. |
| Continuous | Cross-bank beneficiary graph | Beneficiary name appears as recipient from ≥ 3 unrelated source accounts within RBL + shared via NPCI's emerging Beneficiary-Risk-Hub. | Auto-add to internal blacklist; future debits require manual approval. |
| Continuous | SIM-binding for IB | Login attempt from a foreign IP without prior travel-flag notification. | Force OTP + selfie on a registered device only. |
A simple weighted score combining the above rules. Re-computed nightly. A score of ≥ 60 auto-freezes outbound; ≥ 75 triggers an STR draft to FIU-IND.
| Component | Weight | ESYECCO score |
|---|---|---|
| Non-browser UA seen on IB | +25 | +25 |
| Cron-style login periodicity | +15 | +15 |
| Impossible-travel events ≥ 3 in 30 days | +15 | +15 |
| Residential-proxy or WARP on corp IB | +10 | +10 |
| Cloud-DC ASN on retail/LLP segment | +10 | +10 |
| Concurrent multi-IP session | +10 | +10 |
| Pass-through velocity (closing/credit < 0.05) | +15 | +15 |
| Bulk-NEFT bounceback fingerprint | +15 | +15 |
| Fan-out to shadow beneficiaries | +10 | +10 |
| UPI from personal VPAs into current a/c | +5 | +5 |
| KYC velocity-vs-profile mismatch | +10 | +10 |
| Device-fingerprint churn (≥8 IPs / 7d) | +10 | +10 |
| TOTAL | / 150 | 150 / 150 |
ESYECCO ESHOPEE LLP tripped every single component — a perfect score. A correctly-tuned engine would have caught it on or before 10 May 2026, before the largest fan-out days.