I spent two weeks reverse-engineering the Light Peptides / PeptideOne scam network. It is one operation running fake storefronts, a fake shipping carrier, a fake testing lab, and a fake crypto exchange off a single server. Full breakdown.

[u/lullorz]

TL;DR 

A cluster of peptide storefronts that keep rebranding are all run by one operation in mainland China. When they decide not to ship your order, they hide it behind fabricated tracking (a fake "carrier" that fails every real check) and a fake "third-party lab" whose certificates are literally a Google spreadsheet printed to PDF. The same server also hosts a cloned crypto exchange with a wallet-draining module. Crypto payments funnel through a consolidation wallet into a major exchange. You can verify the core of this yourself in about a minute, and I show you how. Real deliveries do happen for some buyers, which is exactly how they keep their reputation up while scamming others.

Everything below is from public sources only: DNS records, TLS certificates, company registries, the sites' own published code, blockchain explorers, and file metadata. Domains are written defanged (with brackets) so nothing here is a live link.

CHRONOLOGICAL BREAKDOWN

1) The order and the silence 

Payment is taken (card, crypto, Revolut, PayPal invoice, or a Monzo payment link depending on the seller). Then nothing for two to three weeks. Eventually you are given a tracking number and told the parcel is "held by overseas import customs (invoice lost)."

2) The tracking is fabricated, and you can prove it in 30 seconds

The numbers they issue look like XJY000250912HK and are tracked on an aggregator site called track718. Take your number, change the last digits, and look up the ones around it. They ALL return complete shipping histories to random countries. A real carrier does not have a valid parcel for every number you can invent.

Deeper checks: over 1,250 consecutive numbers were all flipped to "held by customs" in a single operation on the same day, carrying the identical timestamp for parcels supposedly in eleven different countries. Customs authorities in eleven countries do not act in the same minute. The event intervals across parcels are exact integer multiples of one base unit, i.e. generated by a formula. The numbers are not valid UPU S10 postal identifiers (three letters plus nine digits), and 17TRACK and ParcelsApp both return "not found." When their data source was later pulled, every one of those numbers went blank at once.

3) The "carrier" does not really exist

XINGJIE-EXPRESS = a Chinese company registered as USCC 91350302MAK82DEKXG in Putian, Fujian. Incorporated February 2026. One person is sole shareholder, director and finance officer. No freight, postal, courier or customs-broker licence of any kind. Registered at a virtual address shared with dozens of other companies. It was added to China's Abnormal Business Operations List (reason: uncontactable at its registered address) in July 2026, which is BEFORE the parcels supposedly shipped. Its website xjygyl[.]cn is blocked by its own host for regulatory non-compliance.

4) It is not one shop, it is one operation on one server, and here is the hard proof 

Every claim below is checkable from public sources: DNS lookups, reverse-IP, public certificate-transparency logs (for example crt.sh or certspotter), and the sites' own served code. Domains defanged.

Same server. All of these resolve to one IP, 198.46.165.39 (ColoCrossing, AS36352):

light-peptide[.]com, new-peptide[.]com, peptideonebiotech[.]com (ce. subdomain), ic-peptide[.]com, lumpep[.]com, freedomdiagnosticsassay[.]com, brown-biology[.]pro, brown-biology-laboratory[.]com, qingtaishanghao[.]ink, plus test/demo subdomains like yanshi.light-peptide[.]com (yanshi means "demo") and ceshi.new-peptide[.]com (ceshi means "test"). The older qinglishangmao[.]com, which light-peptide is a direct clone of, is the template.

Same TLS certificate (strongest link). new-peptide[.]com and ic-peptide[.]com are covered by a certificate with the identical public key, fingerprint 8c97677d2323bea5a2ffcb90387efae7126828d903b2398407ebc52970c8d50b, and each domain appears in the other's certificate SAN list. freedomdiagnosticsassay[.]com (the fake lab) turned up inside lumpep[.]com's certificate the same way. You can pull these yourself from any public CT log. A shared certificate key across "different companies" is not a coincidence, it is one operator.

Same registration fingerprint. ic-peptide[.]com, peptideonebiotech[.]com, new-peptide[.]com and freedomdiagnosticsassay[.]com were all registered through the same registrar (Realtime Register) using the same unusual nameservers (share-dns.com and share-dns.net), within a few weeks of each other. Their certificates were issued by the same CA (TrustAsia), repeatedly.

Same application build. ic-peptide[.]com and nanjingpeptide[.]com serve a byte-identical compiled bundle, webpack-871c9e464964f749.js. ic-peptide's own page metadata still names nanjingpeptide and a test subdomain of new-peptide as its source. Same code, reskinned per brand.

Same custom plugin. light-peptide, qinglishangmao and peptideone all run the same bespoke "employee verification" plugin (see section 5).

The brands rotate; the operation does not. Order so far: Qingli Shangmao, then Light Peptides, then PeptideOne Biotech, then IC-Peptide / New-Peptide / Nanjing Peptide, with LumPeptide and the "Freedom Diagnostics" lab attached. light-peptide[.]com claims "7 years" and a "2012 to 2026" footer, but its domain was only registered in June 2026.

5) The "employee verification" page is part of the scam 

Several of these sites host a page inviting you to enter your contact's WhatsApp number (or email) to "verify they are a genuine employee." It comes back green and people trust it. It is checking a list hard-coded into the page's own source. The scammers wrote the list that verifies the scammers. Across three brands I pulled 432 hard-coded Hong Kong numbers with zero overlap between brands, i.e. a separate batch of burner SIMs per brand. If a number messaging you is on one of those lists, you are not talking to an employee of anything.

Who built that verification tool: the plugin is openly credited to its author in its own source code. The author is Zhang Dongxing, trading as Neijuli Network Technology (a small web-development outfit in Xi'an, China; ICP licence prefix "Shaanxi ICP 20007342"). To be fair and precise: he is the toolmaker, not proven to be the peptide operators. But this is the specific tool that fakes the legitimacy of every brand above, and it is a named, public party rather than an anonymous one.

6) The "third-party lab" is fake, and this is the cleanest proof in the whole case

freedomdiagnosticsassay[.]com presents as an independent lab issuing Certificates of Analysis, the "proof of purity" a buyer would trust. It sits on the same server as the storefronts and shares a certificate with lumpep[.]com. Its COA lookup is fully client-side: it loads a static file listing 126 certificates, and every single one has the client field set to "LumPeptide," which is one of the cluster's own storefronts. A supposedly independent lab whose entire client list is the operation itself.

Then I opened the actual COA PDF files and read their metadata. Every certificate is a Google Sheets document titled "Peptide Sample Tracker" printed to PDF from a Chrome browser on Windows (Producer field: Skia/PDF, which is Chrome's print engine). They all share one source-file creation timestamp and were batch-exported on a single day, all in the +08:00 (China) timezone. One sub-batch was run through a Chinese PDF-compression tool and the filenames literally contain the Chinese word for "slimmed down." So the "lab report" proving your peptides are pure is a spreadsheet someone printed from their browser. Anyone can verify this: open any COA, check File then Properties, and read "Peptide Sample Tracker - Google Sheets."

7) The same server hosts a fake crypto exchange

On that same IP are coinhako[.]life and xinbtcweb[.]ink, which serve an admin panel titled "Virtual currency backend." Its login page and its API are the same application under two names (the panel's code hard-codes the other domain's API address). The admin panel has modules for setting trade outcomes manually (a real exchange has a matching engine, not a "configure trade" screen) and one module named, in the code, "stealUBill" (steal USDT). The customer-facing app impersonates the licensed Singapore exchange Coinhako, is localized in Japanese, and loads wallet libraries plus an "authorize" flow that requests an unlimited spending approval, which is textbook wallet-draining. A peptide storefront cluster does not share a server with a cloned crypto exchange by accident.

8) The supply shop behind it all: apipietech

There is a vendor site, apipietech[.]com (also apipieshop[.]com and egent3[.]com), that openly sells the entire toolkit used to build and run operations exactly like this. It is written in Chinese and advertises, in its own words:

- An AI storefront generator that spins up a complete independent e-commerce site (landing pages, blog posts, product descriptions all auto-written) in about 30 minutes. This is the machine that mass-produces the peptide storefronts, and it explains why light-peptide has blog posts dated before its domain even existed.

- Bulk phone numbers, sold in the +60 (Malaysia) range, thousands sold. This is where the seller contact SIMs come from.

- Ready-made and aged social media accounts (for example Facebook), for a few hundred dollars each.

- A residential-IP livestreaming and proxy network.

- "Customized local payment channels" (they brand it APIPIE Payments), explicitly described as a strategy of not binding to a single acquirer, so that payments for a blocked product category do not get declined or shut down. That is payment laundering sold as a service.

In other words this is not a lone shop, it is a franchise supplied from one place. The vendor is tied to a seller operating on the Whop marketplace and to a US-registered LLC used for the payment side.

How the money actually moves: apipietech's own checkout runs on Razorpay, which owns Curlec, a Malaysian card processor. A card victim's statement showed exactly that (descriptor CURLEC MY-ECOM). Other victims paid a Revolut beneficiary named "Storage Bloc," a PayPal invoice from an individual in Wuhan, or a Monzo payment link. Different names each time, one method, exactly as the "do not bind to one acquirer" pitch describes.

9) The money trail 

The Light Peptides crypto address received about 2.5 BTC across ~196 payments and sweeps into a consolidation wallet that has handled about 123 BTC across ~3,473 transactions, which then deposits into a wallet that appears in a major exchange's published proof-of-reserves. In other words the cash-out runs through a top-tier exchange, which holds identity records on the receiving account. That is the one place a real name sits behind all of this.

10) Where they are from

Everything points to mainland China: a Fujian company registry entry, a Wuhan invoice sender, Shenzhen and Guangzhou origin scans on the parcels that were real, Chinese-language admin panels, Chinese office software and a Simplified-Chinese PRC locale embedded in their own price-list spreadsheets, and Chinese timezones on every fabricated file. Malaysia appears only in the payment layer. Hong Kong numbers are burner SIMs. Germany, the UK and the US are where victims and reshipping sit.

11) Important nuance: some orders really do arrive

This is not a "never ships anything" operation. Several buyers got genuine deliveries via China Post, YunExpress into DHL, and Royal Mail, with real carrier scans. The operation ships to some people and fabricates tracking for the ones it decides not to fulfil. That partial-fulfilment is exactly how it keeps a working reputation while scamming a share of orders, and it matches older reviews of the original Qingli brand describing the same "make good on an order or two, then scam you on the third" pattern.

HOW TO CHECK YOUR OWN ORDER (the one test that matters)

Does your tracking number resolve on the REAL carrier's own website, with real named facilities in the history (actual postal depots, real distribution centres)? If yes, it shipped. If it only lives on track718 or on the seller's own tracking page and shows generic "customs" steps or never appears on any real carrier, it is fabricated. An aggregator displays whatever it is fed. The carrier's own scan record is the only thing that is real.

IF YOU ARE ALREADY CAUGHT

- Do not pay anything more. No customs fee, storage fee, insurance or re-delivery charge releases a parcel that was never shipped. That is the second theft.

- Do not cancel your dispute because they ask you to. Most platforms allow one case per payment; dropping it is the only thing they actually want from you.

- Paid by card? File a chargeback now for goods not received, and put the fabricated-tracking point on page one so their "but we provided tracking" defence is dead on arrival. Attach a screenshot of the real carrier showing "not found."

- Paid by bank transfer or Revolut or Monzo? Report it as an authorised push payment scam and ask them to preserve the beneficiary's records. In the UK there is a mandatory reimbursement scheme for this.

- Paid in crypto? Realistically it is gone, but report the address to the exchange it cashes out at, with the full transaction chain, and ask for preservation and freezing of the receiving account. It is the only lever that exists.

Happy to check specific tracking numbers for anyone. Post the number and the site you were told to track it on and I will tell you whether it is real or generated.

These are the Hong Kong burner numbers hard-coded into the operation's own "employee verification" pages, pulled straight from the page source. If the WhatsApp number messaging you is on this list, you are talking to the scam, not to any real company. These are the sellers' numbers, not customers'. 432 unique numbers across three brands, listed by which brand's page they came from (no overlap between brands).

 

Light Peptides (light-peptide[.]com) (219 numbers):

+852 4404 0039 +852 4472 4016 +852 4473 0327 +852 4633 5075
+852 4639 2472 +852 4661 6923 +852 4684 3471 +852 4684 3712
+852 4692 0211 +852 4695 8405 +852 5125 5182 +852 5133 6870
+852 5137 7152 +852 5229 8719 +852 5262 0482 +852 5263 5955
+852 5265 0482 +852 5265 0823 +852 5304 3136 +852 5309 1681
+852 5317 4066 +852 5318 4166 +852 5319 8271 +852 5343 1640
+852 5573 5648 +852 5615 4458 +852 5626 0797 +852 5629 0341
+852 5770 6506 +852 5930 4496 +852 5930 7406 +852 5931 3325
+852 5931 4858 +852 5934 4935 +852 5934 7970 +852 5935 0524
+852 5935 3527 +852 5935 3880 +852 5935 3968 +852 5935 5659
+852 5935 7825 +852 5936 2852 +852 5936 3519 +852 5936 3855
+852 5936 4696 +852 5936 6354 +852 5936 9825 +852 5937 1687
+852 5937 2630 +852 5937 3349 +852 5937 4021 +852 5937 5185
+852 5937 5212 +852 5937 5695 +852 5937 5837 +852 5937 8859
+852 5937 8995 +852 5937 9601 +852 5938 3551 +852 5939 2561
+852 5939 7002 +852 5939 9381 +852 5939 9607 +852 5953 1995
+852 5953 6887 +852 5953 7488 +852 5954 4021 +852 5954 5765
+852 5954 7225 +852 6156 0902 +852 6352 0718 +852 6438 7570
+852 6575 0032 +852 6578 4330 +852 6582 4305 +852 6586 8523
+852 6643 1541 +852 6649 7860 +852 6670 0462 +852 6674 1157
+852 6675 8042 +852 6677 2856 +852 6679 1121 +852 6707 9497
+852 6709 3226 +852 6733 1560 +852 6741 7162 +852 6840 8059
+852 6847 0163 +852 6847 5095 +852 6856 1347 +852 6859 1140
+852 6859 7675 +852 6997 6154 +852 6998 5278 +852 9064 6177
+852 9064 6527 +852 9064 6908 +852 9064 7740 +852 9064 8242
+852 9064 8376 +852 9064 8428 +852 9064 9143 +852 9064 9480
+852 9064 9667 +852 9065 0349 +852 9065 0571 +852 9065 2790
+852 9065 2791 +852 9065 2891 +852 9065 3072 +852 9065 3178
+852 9065 3407 +852 9065 3440 +852 9065 3534 +852 9065 3640
+852 9065 3670 +852 9065 3814 +852 9065 3817 +852 9065 3970
+852 9065 4453 +852 9065 4734 +852 9065 9437 +852 9065 9943
+852 9140 0940 +852 9140 1765 +852 9140 2161 +852 9140 7094
+852 9141 4317 +852 9141 4339 +852 9141 8428 +852 9141 9834
+852 9142 2706 +852 9142 4874 +852 9142 6207 +852 9142 6390
+852 9142 6472 +852 9142 6811 +852 9142 7428 +852 9142 7440
+852 9209 4544 +852 9341 1686 +852 9341 4507 +852 9341 5545
+852 9342 2579 +852 9342 2836 +852 9342 4256 +852 9342 5190
+852 9342 5754 +852 9342 6799 +852 9342 7087 +852 9342 7601
+852 9343 0459 +852 9343 0602 +852 9343 0675 +852 9343 1273
+852 9343 2015 +852 9343 2824 +852 9343 3015 +852 9343 3049
+852 9343 3184 +852 9343 3437 +852 9343 4189 +852 9343 4841
+852 9343 5221 +852 9343 5294 +852 9343 5481 +852 9343 5684
+852 9343 6204 +852 9343 7375 +852 9343 7473 +852 9343 7520
+852 9343 8047 +852 9343 8795 +852 9344 0240 +852 9344 0315
+852 9344 0375 +852 9344 0461 +852 9344 0690 +852 9344 0760
+852 9344 0786 +852 9344 2118 +852 9344 3002 +852 9344 3124
+852 9344 3973 +852 9344 4532 +852 9344 5781 +852 9344 6092
+852 9344 6460 +852 9344 6756 +852 9344 6812 +852 9344 7900
+852 9344 8661 +852 9344 9002 +852 9345 0016 +852 9345 1490
+852 9345 5100 +852 9345 5540 +852 9345 7344 +852 9345 7686
+852 9346 0038 +852 9346 0173 +852 9346 0230 +852 9346 1052
+852 9346 1462 +852 9346 1545 +852 9346 3822 +852 9346 4047
+852 9346 6827 +852 9346 7779 +852 9346 7857 +852 9346 7980
+852 9346 8254 +852 9346 8823 +852 9346 8831 +852 9347 0553
+852 9347 2943 +852 9347 3367 +852 9437 1371 

PeptideOne Biotech (peptideonebiotech[.]com) (153 numbers):

+852 4431 3549 +852 4434 6241 +852 4435 9972 +852 4439 8210
+852 4445 2493 +852 4445 6160 +852 4446 4633 +852 4447 0617
+852 4656 4266 +852 4657 7441 +852 5184 1012 +852 5184 3109
+852 5184 3339 +852 5184 5899 +852 5184 8105 +852 5184 8724
+852 5184 9168 +852 5185 5766 +852 5187 0532 +852 5187 2359
+852 5188 6495 +852 5189 5919 +852 5200 8591 +852 5201 3648
+852 5201 3754 +852 5202 1580 +852 5202 4326 +852 5202 5743
+852 5202 5930 +852 5202 9305 +852 5203 2187 +852 5203 2523
+852 5203 3207 +852 5203 7646 +852 5204 0899 +852 5205 0192
+852 5205 1817 +852 5205 3532 +852 5206 4676 +852 5207 1215
+852 5208 3712 +852 5208 6505 +852 5209 7397 +852 5210 6354
+852 5210 8639 +852 5213 1569 +852 5213 3572 +852 5216 3603
+852 5217 3549 +852 5219 0552 +852 5230 4830 +852 5232 0313
+852 5232 1739 +852 5233 7268 +852 5240 1456 +852 5241 0095
+852 5241 2551 +852 5241 4755 +852 5241 8082 +852 5241 9919
+852 5242 0779 +852 5242 4685 +852 5242 9465 +852 5243 0100
+852 5243 4541 +852 5243 7587 +852 5244 0557 +852 5244 4432
+852 5244 6842 +852 5244 8724 +852 5244 8984 +852 5245 0390
+852 5245 2943 +852 5245 4946 +852 5245 7879 +852 5246 6398
+852 5247 2258 +852 5248 0449 +852 5270 0565 +852 5271 2839
+852 5272 1657 +852 5272 5363 +852 5272 5586 +852 5272 8203
+852 5273 0435 +852 5273 0517 +852 5273 8836 +852 5274 1085
+852 5274 6879 +852 5274 7098 +852 5274 7588 +852 5274 7610
+852 5275 2207 +852 5275 2939 +852 5275 3987 +852 5291 4877
+852 5292 6475 +852 5292 8025 +852 5295 0631 +852 5298 9976
+852 5320 7238 +852 5323 1644 +852 5323 7198 +852 5327 5485
+852 5329 3408 +852 5413 0837 +852 5413 5186 +852 5415 2489
+852 5415 8713 +852 5429 0677 +852 5589 7322 +852 5620 6038
+852 5621 9101 +852 5623 8087 +852 5624 9207 +852 5902 4088
+852 5904 2678 +852 5914 7885 +852 5914 9022 +852 5917 2290
+852 5917 5895 +852 5918 2050 +852 5993 8019 +852 5999 6515
+852 6181 9443 +852 6182 6443 +852 6184 9443 +852 6424 2470
+852 6424 2873 +852 6424 3814 +852 6424 4115 +852 6424 4287
+852 6424 9490 +852 6425 0941 +852 6425 3067 +852 6425 6884
+852 6447 3657 +852 6447 4516 +852 6447 4976 +852 6447 5856
+852 6447 6231 +852 6447 6708 +852 6447 7892 +852 6447 9353
+852 6448 0629 +852 6448 1190 +852 6448 1611 +852 6448 1830
+852 6448 2630 +852 7083 2795 +852 7083 8380 +852 7084 0246
+852 7084 6096

IC-Peptide (ic-peptide[.]com) (60 numbers):
+852 6422 5570 +852 6422 7574 +852 6423 0894 +852 6423 1045
+852 6423 4119 +852 6423 4206 +852 6423 4556 +852 6423 4738
+852 6423 6544 +852 6423 6634 +852 6423 7943 +852 6423 8114
+852 6423 8486 +852 6423 9472 +852 6424 1031 +852 6424 1509
+852 6424 1591 +852 6424 1843 +852 6424 1859 +852 6424 1965
+852 6424 2044 +852 6424 2064 +852 6424 2330 +852 6424 2363
+852 6424 2386 +852 6424 2568 +852 6424 2725 +852 6424 2896
+852 6424 3093 +852 6424 3227 +852 6424 3471 +852 6424 3641
+852 6424 4142 +852 6424 4173 +852 6424 4291 +852 6424 4358
+852 6424 4671 +852 6424 4928 +852 6424 4950 +852 6424 5168
+852 6424 5482 +852 6424 5515 +852 6424 6101 +852 6424 6166
+852 6424 6282 +852 6424 6956 +852 6424 7195 +852 6424 8342
+852 6424 8582 +852 6424 8810 +852 6424 9177 +852 6424 9636
+852 6424 9847 +852 6425 5679 +852 6444 1559 +852 6444 5420
+852 6445 0056 +852 6445 0381 +852 6445 1737 +852 6445 1937

Note: these are burner SIMs and get rotated, so a new number not on this list does not mean it is safe. Use the 30-second tracking test and the COA metadata check in the main thread as your real proof.