Investigation: how the fake investment review factory works, with 16,000 names and a handful of forms
In this article
In short: when someone sees an investment ad and searches for “reviews” of the platform, they usually end up on a review page. We crawled 49,028 pages from 9 review sites. They contain 45,224 sign-up links carrying more than 16,000 platform names, but those links pass through just 4 intermediate domains. And 229 of the 256 platforms we have detected in ads (89%) have reviews on those sites. These pages are the second half of the ad.
What we did
Between 5 and 6 November 2026 we read, as plain text, the pages of 9 sites that publish reviews in bulk, without filling in any form. We then searched Google and Google Videos for every platform in our database, leaving out those 9 sites in order to find others. We tried to open 1,602 of those pages to see where they linked, and 1,050 responded.
| Intermediate domain | Distinct links | Platform names | Review sites using it |
|---|---|---|---|
| coinpulse[.]cc | 28,600 | 10,614 | 3 |
| profitpath[.]cc | 8,298 | 3,997 | 4 |
| crystalpinefinance[.]com | 6,969 | 6,529 | 1 |
| scaleforce-platform[.]com | 275 | 266 | 1 |
The same name can appear on several domains, so these figures cannot be added together.
Important: a name appearing on these sites does not prove that the platform is a scam. These sites also use the names of real companies and well-known products, because people search for them. That is why we are not publishing the full list. What we can state is where the button leads.
One form, a thousand names
Most of these links end on a sign-up page that takes on whatever name the link gives it. If the link says “Platform A”, the page is called Platform A. If it says “Platform B”, it is called Platform B. The form, which asks for an email address and phone number, is the same.
That is why one of these “platforms” need not exist at all. It may be nothing more than a word in a link. And that is why changing names costs them so little: when a regulator warns about one name, they use another the next day.
We also found sites that always show the same brand, whichever platform the review is about. Someone reading about one platform ends up on a different one, which promises income and tells them to wait for a call from a “personal account manager”.
The titles come from a template
On just one of these sites, the 9,706 English-language reviews use nine titles, split almost evenly: “Scam or Safe?”, “Real or Fake?”, “Legit or Not?”, “Smart Move or Mistake?”, “Trustworthy or Trash?”, “Worth It or Not?”, “Good Deal or Bad Deal?”, “Verified or Unverified?” and “Safe Bet or Risky?”. Each one appears between 1,020 and 1,108 times.
The title poses exactly the question the reader has, so that it comes up first when they search for “[name] scam”. No newsroom publishes thousands of analyses under nine titles.
And the pace is not human. In August 2026 these sites published 533 dated reviews. In September there were 10,422, and in October, 13,114.
One domain falls and another replaces it within hours
While carrying out this investigation we saw how the network defends itself. On 5 November, the coinpulse[.]cc links led to kryptofokus[.]co. That night, the domain was suspended at the registry. Less than 14 hours later, the same links were already leading to another domain, profitflex[.]co, and the review pages had not changed.
That is the role of the intermediate domain: it makes it possible to change the destination of tens of thousands of links at once. What is more, the two domains were created in the same second, on 11 August 2026. The two intermediate domains in this branch were also created at the same moment, nine seconds earlier.
The reviews often arrive before the ad
For 144 platforms, the first dated review is older than the first ad we detected. The median head start is 29 days, and in 37 cases it is more than three months.
This figure needs reading with care: we started monitoring the ads on 26 October 2026, so we do not know whether there were others before that. But the practical conclusion is clear: a platform having reviews from months ago does not mean it is old or reliable.
Beyond the review sites
Searching outside those 9 sites turned up three other methods.
Free blogs with a celebrity’s name. There are blogs whose address combines the name of a well-known person and the name of the platform, to catch people who search for the two together after seeing the ad. The same happens on free services for digital exhibitions, notes and videos. Their links pass through another group of domains (monexory[.]com, capitalorya[.]com, fundevora[.]com, prosperityora[.]com), with the same format and the same codes repeated across different domains.
Those domains share a registrar and name servers with several of those that appear in YouTube videos, such as fynvexes[.]com. That points to shared management, although it does not prove it. If you open them directly they respond “not found”, just like fynvexes[.]com: we have not been able to see who they send people to.
Tampered legitimate sites. We found review pages hosted on other people’s websites: law firms, small businesses, and websites of public bodies and universities. The address looks like the institution’s, but the content comes from elsewhere. We had already documented this technique on university websites. Their owners are victims, which is why we do not name them here.
“Official” sites in series. In this round we added 106 sites with forms to the platform pages. There are now 1,098 domains linked to our 256 platforms. Many have the country in their name or use cheap domain extensions, and several use words unrelated to the platform.
What this means for you
- Reviews are no use for checking a platform from an ad. Search your country’s regulator’s register, not Google.
- Look at what is at the end of the review. If the button leads to a form asking for your phone number, it is not an independent opinion. There are more signs in how to spot fake reviews.
- Do not trust the date. An old review does not prove the company has existed since then.
- The name matters little. Even if it does not appear in any warning, it may be the same scam under another name. We explain this in why they change names.
If you have already given your phone number or paid, follow the victim guide.
Limitations of this investigation
- We only read the text of the pages: we did not fill in forms or speak to anyone in the network.
- We cannot say that all the sites have the same owner. The data shows shared tools and practices.
- We did not check each of the 45,224 links: we checked samples from each intermediate domain.
- One review site blocked part of our reading and was left out.
- Searches show what Google displays, not everything that exists. The figures are a minimum.