Investigation: investment scams plant fake reviews on hacked university websites
In short: when someone searches Google to check whether an investment platform advertised with celebrities is a scam, they often find “reviews” saying it is not. InvestRedFlags reviewed the search results for the platforms we detect in ads and found that a significant share of those reviews is hosted on the websites of universities, public bodies and NGOs, placed there by third parties without their owners’ knowledge.
What we found
On 29 and 30 October 2026 we searched Google for the names of platforms in our database together with words such as review, scam or legit. For several of the best-known names, including Quantum AI, Immediate Edge, Immediate Growth and Power Trades, some of the top results were pages with near-identical titles like “Review 2025! Scam or Legit? Real Users & Results – Is It Worth €250?”. They were hosted on domains such as:
| Domain | Institution | Platforms promoted |
|---|---|---|
| sitehost.iu.edu, ppmi.iu.edu, polis.indianapolis.iu.edu | Indiana University (US) | Quantum AI, Power Trades, Immediate Growth, Fluxquant, Bitcoin 360 AI and others |
| hci.bournemouth.ac.uk | Bournemouth University (UK) | Fluxquant, Elitux Flux, Singfable Flux |
| ioc.studentorg.berkeley.edu | UC Berkeley student organisation (US) | Bitcoin Everest AI |
| med.upc.edu | Universitat Politècnica de Catalunya (Spain) | Immediate Edge |
| ilc-2022.enea.it | ENEA, Italian public energy agency | Immediate Edge |
| bedah.fk.ui.ac.id | Universitas Indonesia | Immediate Edge |
| mis.wmi.amu.edu.pl | Adam Mickiewicz University (Poland) | Immediate Edge |
| bizcom.srru.ac.th | Surindra Rajabhat University (Thailand) | Immediate Edge |
| carerescif.hcmut.edu.vn | Ho Chi Minh City University of Technology (Vietnam) | Quantum AI |
| clima.transparenciainternacional.org.br | Transparency International Brazil | Immediate Edge |
These institutions are victims, not culprits. Most likely someone exploited an old website, a forgotten subdomain or an outdated WordPress install to upload hundreds of pages. When we checked again on 30 October, several had already been removed, but they still appeared in search engines.
Why they do it
Search engines treat content on a reputable domain as more trustworthy. A page on a university or government site ranks much faster than a brand-new blog. The technique is known as parasite SEO. It has been documented for adult content, gambling and weight-loss products: in May 2026 The Stanford Daily reported such attacks on Stanford subdomains. What we found is that investment scam networks use the same technique for their “reputation”.
The goal is simple: someone sees the ad, has doubts and searches Google. If the first thing they find, on a site with “university” in its name, says the platform is “not a scam”, they are more likely to leave their phone number.
The rest of the fake review ecosystem
Hacked websites are only one part. For the same platforms we found:
- Paid advertorials in newspapers. Some newspapers sell space labelled “brand PR”, “partner exclusives”, “impact feature” or “spotlight”. We saw favourable reviews of these platforms in such sections of outlets like Tribune India, Deccan Herald and Outlook India. The label is usually small and readers think it is the newspaper’s own article.
- Press releases distributed by wire services, which are automatically republished on business portals.
- Free documents and groups: HackMD pages, Google Groups, Google Sites, Substack or Medium, all linking to the same sign-up form.
- Sites built in minutes on free hosting (.pages.dev, .netlify.app), with names like “platform-review” or “platform-canada”.
On each InvestRedFlags platform page we list the sites where we found such pages, as plain text and without links.
How to protect yourself
- Distrust reviews that end in a form. An independent review does not ask for your phone number.
- Look at the domain, not just the title. A “trading review” on a medical department’s website or a 2022 conference site is out of place.
- Look for “sponsored” or “partner” on press articles that recommend it.
- Always check your regulator’s register before investing. See our guides on checking whether a broker is regulated and on fake reviews.
For affected institutions
If you manage one of these sites, search Google for site:yourdomain "review" "scam or legit" to find pages you did not publish. Also check old subdomains and unmaintained WordPress or video installs. If you would like us to update this information, contact us.
Methodology: manual search engine queries on 29 and 30 October 2026 using platform names from our database. We only include domains where the result title or snippet showed a review of an investment platform. We did not open the pages, to avoid exposure to malware; availability was checked with a technical request only.