Case 006 — Investor Verlag / FID Verlag
Misleading Investment Advertising · boersenwissen-aktuell.de

The site is served as a static HTML bundle from an AWS S3 bucket, distributed globally via CloudFront with edge nodes in Amsterdam (AMS1). The root domain redirects to www.boersenwissen-aktuell.de/index.html, confirming S3 static website hosting. This is a deliberate infrastructure choice: S3 provides virtually unlimited scale at minimal cost, and CloudFront ensures fast delivery — appropriate for a high-traffic lead generation campaign.

The page was built with Brizy (a drag-and-drop website builder), evidenced by the .brz-css-* class namespace throughout the HTML. Content was last updated 2026-06-17 per S3 ETag metadata.

The operator is identified from two direct sources embedded in the page itself:

• Cookie consent footer text: "E-Mail-Newsletter: Millers Krypto-Radar, Herausgeber: Investor Verlag | FID Verlag GmbH. Sie können sich jederzeit über einen Link am Ende jeder Ausgabe oder unter 0228 9550-400 abmelden." (Publisher: Investor Verlag | FID Verlag GmbH. You can unsubscribe at any time via a link at the end of each edition or by calling 0228 9550-400.)
• Customer service email in the disclaimer: kundenservice@vnr.de — VNR = Verlag für die Deutsche Wirtschaft AG, the parent company of FID Verlag and Investor Verlag.
• Pixel tracker: cdn.static.vnr-advance.de/pixel/0.4/advance-pixel.min.js — VNR Advance is the digital marketing arm of Verlag für die Deutsche Wirtschaft AG.
• Risk disclosure PDF hosted at: shop.investor-verlag.de/risikohinweise/Investor-Sonderreport-Risikohinweis.pdf

The page makes highly specific investment recommendations without any BaFin license or disclaimer that the operator holds a §34f GewO (financial investment advisor) registration or MiFID II authorization. Under EU MiFID II and the German WpHG (Securities Trading Act), making specific buy/sell recommendations to retail investors requires a license.

The following claims extracted from the page constitute unlicensed investment advice:

The form embed source code reveals a structured affiliate tracking system. Each "free report" download form carries a data-nss-affiliate parameter that encodes the full marketing chain. Decoding these reveals the entire distribution network:

What happens when a victim "downloads the free report": They submit their email address through fid-nss.de's form. They are subscribed to one or more investment newsletters (MKR, DM, ISD). The affiliate tracking ensures FID/VNR can attribute the subscription to the traffic source (IRW) and campaign. The newsletters then send ongoing investment "tips" — the classic lead-harvest funnel: create buzz, drive traffic, collect emails, send recommendations. Whether the operator profits from price movements in recommended assets (classic pump-and-dump) was not confirmed through passive OSINT; what is documented is the MiFID II-violating advertising claims and unlicensed investment marketing.

The cookie consent popup, photographically captured during investigation, contains an explicit admission of GDPR-violating data handling. The full text (translated) states:

"Depending on the function, data is thereby transferred to third parties and to third parties in countries outside the EU / EEA where there is no EU-adequate level of data protection and the security authorities of the third country have comparable legal remedies without an adequacy decision applying, or where an adequacy decision applies but its conditions are not met by every company concerned (incl. US companies)."

This statement is a direct admission of GDPR Article 44-49 violations — data transfers to third countries (specifically named: USA) without an adequate legal basis for the transfer.

• Article 13 violation: Inadequate transparency about what data is shared with whom and which third countries
• Article 44 violation: Transfer of personal data (email addresses) to non-adequate third countries without Binding Corporate Rules, Standard Contractual Clauses, or explicit consent for the specific transfer
• Article 6 violation: Unclear legal basis for processing subscriber data across the affiliate network (KOOP partners)

Additional public-record research confirms FID Verlag GmbH is a documented repeat offender — already subject to formal Unterlassungsklagen (cease-and-desist lawsuits) by German consumer protection agencies before this investigation:

• Verbraucherzentrale Baden-Württemberg vs. FID Verlag GmbH (Case I-96259) — filed at Cologne District Court. Grounds: misleading advertising and illegal hidden subscription contracts. (Source: Bundesjustizamt injunction registry)
• Verbraucherzentrale Bundesverband vs. FID Verlag GmbH (Case V-121559) — national-level consumer federation action. Grounds: deceptive commercial practices in newsletter marketing.
• Verbraucherzentrale Baden-Württemberg vs. FID Verlag GmbH (Case III-98245) — second action by Baden-Württemberg consumer agency.

These are not allegations — they are formally registered injunction proceedings in the Bundesjustizamt Verbandsklagenregister (Federal Justice Office class-action registry), publicly searchable. FID Verlag GmbH is aware of its obligations and continues the same practices documented here.

On 2026-08-18, a controlled honeypot test was conducted: fresh Proton Mail account, residential VPN exit node, incognito browser session. The target: boersenwissen-aktuell.de — subscribe for the "free PDF" offer. The full funnel was captured end-to-end.

Step 1 — Email delivery confirmed. The confirmation email arrived from fid-nss.de (the activation backend identified in Finding 2). Subject line delivered verbatim:

Step 2 — Hidden dual opt-in disclosed in activation link page. The welcome page displayed a notice that was not visible at signup time:

Step 3 — UWG §7 admission embedded in the newsletter body itself:

Step 4 — The payment funnel: €1 gateway + illegal return claims. The email linked to a product page for a physical book ("Reich mit Kryptowährungen") offered at "0 €" with a symbolic €1 shipping fee. This is a documented dark pattern known as the "Foot-in-the-Door" technique — extracting card or PayPal credentials for a trivial amount to lower friction for high-value upsells. The product page displayed these verbatim claims visible to retail investors:

Step 5 — Affiliate tracking token exposed. The page source contained a hidden tracking string revealing the complete campaign attribution chain:

Step 6 — Pre-checked subscription upsell on payment page. The checkout page added a Spezialreport "Der neue Dollar" at €2.95/month via a pre-checked checkbox — the consumer must actively uncheck it or the subscription auto-enrolls. This violates UWG §6(2) (hidden additional charges) and the EU Consumer Rights Directive Article 22 (pre-ticked boxes for paid options are illegal in EU commerce).

A second email arrived following the initial confirmation. Subject line: "Ihr Download-Link zum kostenlosen PDF-Report" — explicitly promising a download link for the free PDF report the user signed up for. This email never delivered the PDF. Clicking the prominent "Download" call-to-action button opened a new checkout page at lpm.fid-shop.de, not a file download. This is a textbook bait-and-switch: the commercial offer (free PDF) is substituted at point of fulfilment with a secondary sales funnel. UWG §5 applies directly.

The new page immediately launched a fresh upsell: "Wählen Sie jetzt Ihr Geschenk aus" (Choose your gift now), offering three physical books allegedly worth €39.90 each, displayed as "0 €" — again gated behind a €1 symbolic shipping fee, repeating the foot-in-the-door credit card capture mechanic documented in Finding 7.

Fresh unlicensed MiFID II claims on the payment page. The copy on lpm.fid-shop.de contained new unsolicited financial return promises directed at retail visitors:

Second tracking token decoded. The page source revealed a new backend attribution string, structurally distinct from the first-step KOOP token. The system has shifted from lead-capture mode into product-order processing mode:

Infrastructure note: lpm.fid-shop.de is a subdomain of fid-shop.de — a dedicated e-commerce domain operated by FID Verlag GmbH, separate from the lead-generation infrastructure (fid-nss.de) and the front-end ad domain (boersenwissen-aktuell.de). This confirms a three-layer infrastructure: ad domain → activation backend → payment backend. Each layer uses a distinct domain and tracking namespace, deliberately compartmentalised to reduce regulatory surface area per domain.

Bonus IOC: broken mail template variables in received emails. Both emails received during the honeypot test contained unrendered dynamic date placeholders visible in subject lines:

Different threat class from Cases 001-005 — regulatory compliance violations by an identified, established company. Reporting to financial and data protection regulators is fully protected activity under German law (§4d FinDAG whistleblower framework). FID Verlag GmbH cannot sue for truthful regulatory complaints filed in good faith with documented evidence.

Phase 1 — Infrastructure: DNS lookup revealed AWS Route 53 nameservers. HTTP headers confirmed AmazonS3 + CloudFront. Page age from S3 ETag (2026-06-17). TXT records confirmed active Google, Facebook, and Pinterest ad campaigns.

Phase 2 — Operator attribution: Cookie consent footer text contained the publisher name, phone number, and company directly. Customer service email in disclaimer linked to VNR parent company. Pixel tracker domain (vnr-advance.de) confirmed the full corporate tree.

Phase 3 — Affiliate network mapping: The data-nss-affiliate parameters in the embedded form sources decode the entire distribution network — source, newsletter, campaign, and partner all readable in plain text from the page source.

Phase 4 — Legal analysis: Investment claims extracted verbatim, cross-referenced against MiFID II Article 24 requirements for financial marketing communications. GDPR violation lifted directly from the cookie consent text the operator published themselves.

Headless browser screenshot of boersenwissen-aktuell.de captured during investigation. Clearly shows the Investor Verlag logo, the cookie consent popup admitting non-EU data transfers, and the visible claim "alle drei Coins haben das Potenzial … die Erfolgsstory des Bitcoin zu übertrumpfen" (all three coins have the potential to surpass Bitcoin's success story).