Another scam server - this time at tchfunnls.org
They seem to sell the websites to different operators. Some appear to work out of Hong Kong like OnlineInvestmentsGuide.com, others seem to operate from the UK. They all fight over the affiliate fees from the brokers that offer $700 USD for each victim. OIG use https://www.securelyrichday.com/247currencies.php so you can see they operate the whole site in PHP code. This is probably a different group to them.
There does seem to be a correlation between the domain names - tchfunnls.org is very similar to tgfunnls.org and you can indeed see it referenced in the script below from the tchfunnls site:
<script id="script">
const stcih = document.createElement("script")
stcih.async = true
stcih.src = "https://tagstaticx.com/tag.js"
stcih.onload = function(app) {
app.start({
clientId: "8986ccc2-2e26-47a9-9229-e20b23e914d5",
trafficSourceId: "leadB",
fUrl: "https://tgfunnls.org/dly1st/?hitid={clickId}&qze=7&aff_sub={customId1}&aff_sub2={customId2}",
fType: 2,
clickId: app.utils.getParameterByName("cid") || app.utils.getParameterByName("hitid") || "unknown",
customId1: app.utils.getParameterByName("var2") || app.utils.getParameterByName("aff_sub") || "unknown",
customId2: app.utils.getParameterByName("var4") || app.utils.getParameterByName("aff_sub") || "unknown",
})
}
document.head.append(stcih)
</script><script async="" src="./Era_files/tag.js.download"></script>
<script>
(function(w,d,s,l,i){w[l]=w[l]||[];
w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});
var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';
j.async=true;
j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-MSK8GMG');
</script>
<script type="text/javascript" src="./Era_files/conversion.js.download"> </script>
<script type="text/javascript">
window._vwo_code = window._vwo_code || (function(){
var account_id=449005,
settings_tolerance=2000,
library_tolerance=2500,
use_existing_jquery=false,
is_spa=1,
hide_element='body',
f=false,d=document,code={use_existing_jquery:function(){return use_existing_jquery;},library_tolerance:function(){return library_tolerance;},finish:function(){if(!f){f=true;var a=d.getElementById('_vis_opt_path_hides');if(a)a.parentNode.removeChild(a);}},finished:function(){return f;},load:function(a){var b=d.createElement('script');b.src=a;b.type='text/javascript';b.innerText;b.onerror=function(){_vwo_code.finish();};d.getElementsByTagName('head')
[0].appendChild(b);},init:function(){
window.settings_timer=setTimeout('_vwo_code.finish()',settings_tolerance);var a=d.createElement('style'),b=hide_element?hide_element+'{opacity:0 !important;filter:alpha(opacity=0) !important;background:none !important;}':'',h=d.getElementsByTagName('head')[0];a.setAttribute('id','_vis_opt_path_hides');a.setAttribute('type','text/css');if(a.styleSheet)a.styleSheet.cssText=b;else a.appendChild(d.createTextNode(b));h.appendChild(a);this.load('//dev.visualwebsiteoptimizer.com/j.php?a='+account_id+'&u='+encodeURIComponent(d.URL)+'&f='+(+is_spa)+'&r='+Math.random());return settings_timer; }};window._vwo_settings_timer = code.init(); return code; }());
</script><script src="./Era_files/j.php" type="text/javascript"></script>
<script src="./Era_files/tag-bf6f0d1e23328bedfed484057578ca4b.js.download" crossorigin="anonymous" type="text/javascript"></script><script async="" src="./Era_files/hotjar-2304105.js.download"></script><script async="" src="./Era_files/modules.84fa04a166a73fe7fc83.js.download" charset="utf-8"></script>
So they are either copied from that site or owned by the same people.
Another common reference is https://in.bd44.fun/click?$_clickCode=1 which may be somewhere they actually redirect the contacts details from to pass on to the offshore, unregulated broker scammers.
The media files are often kept at this address https://static-13333.kxcdn.com/6532/media/bitcoin.mp4 which may be operated by the website creator as a repository for the files, and as a way to ensure that the operator keeps paying or they will block their server. It may also be an easy way to spread updated media to the affiliates.
As is often the case, they operate a number of scams from the same URL:
https://tchfunnls.org/champion/?hitid=1 Bitcoin Champion Scam
https://tchfunnls.org/edge/?hitid=1 Immediate Edge Scam
https://tchfunnls.org/circuit/?hitid=1 Bitcoin Circuit Scam
https://tchfunnls.org/evolution/?hitid=1 Bitcoin Evolution Scam
https://tchfunnls.org/brexit/?hitid=1 Brexit Millionaire Scam
https://tchfunnls.org/code/?hitid=1 Crypto Code Scam
https://tchfunnls.org/era/?hitid=1 Bitcoin Era Scam
https://tchfunnls.org/billionaire/?hitid=1 Bitcoin Billionaire Scam