Investigation: YouTube videos that “review” investment platforms send viewers to sign up through the same network of domains

Updated on November 7, 2026 · 5 min read

In short: someone who sees an investment ad with a celebrity and searches YouTube for the platform’s name usually finds “analysis” videos concluding that it is reliable. We reviewed those videos for the 184 platforms in our database. For 147 of them there are videos whose description links to the sign-up page through the same redirect domains. One of them, fynvexes[.]com, appears in videos about 114 different platforms advertised in 23 countries. These are not independent reviews: they are part of the recruitment funnel.

What we did

On 3 November 2026 we searched Google Videos for the exact name of every platform we have detected in ads using impersonated celebrities. We left out generic names (such as Trading AI or Quantum AI) that are also used by legitimate products. For each search we reviewed the first ten results without opening the videos or the links: only the title, the date and the description snippet shown by the search engine.

We found 981 YouTube videos about one of these platforms. In 657, the description includes a link to “sign up” or go to the “official site”. 87% of the dated videos had been published in the previous month, many of them in the last few days: they are uploaded at the same pace as the campaigns are launched.

What the videos look like

They almost always follow the same template, in the language of the country the campaign targets:

• A title that raises the doubt and settles it in the platform’s favour: “Legit or Scam? Expert Reviews, Fees and Investment Risks!”, “¿Legítimo o estafa? Costes y riesgos bajo análisis experto”, “Truffa o piattaforma affidabile?”. Some do not even name the platform in the title, only in the description.
• A celebrity’s name before the platform’s: “Jordi Évole Ordalvek España”, “Fabio Panetta Ordalvek EXPOSED”, “Samuel Bendahan Anteilwart Group”, “Justin Trudeau O’Shares Invest”. They are the same celebrities who appear in the ads, and the title targets people who search for “celebrity + platform” after seeing the ad. In 105 videos the title includes a celebrity from our database.
• A description that starts with the link: “Official website of Ordalvek: hxxps://fynvexes[.]com/?f=Ordalvek ✓ Key details…”. The text that follows repeats the same sentences for every platform.

Several channels publish videos about many platforms at once (two of them each appear in the results for seven platforms). Some have names or addresses unrelated to finance, such as gaming channels, which suggests old channels have been bought or repurposed.

The redirect domains

The link in the description hardly ever goes to the platform’s own website. It goes to an intermediate domain that takes the platform’s name as a parameter (for example ?f=Ordalvek or /e/platform-name) and redirects to the sign-up form. One domain can therefore serve hundreds of videos and platforms, and whoever controls it can change the destination whenever a site goes down or a bank blocks it.

Nine of these domains were registered with the same registrar on just two days, 5 and 10 October 2026, and their names follow the same pattern (fin, reg, invest, ai). They are very likely run by the same group. When we checked, none was on the Bank of Russia warning list, which usually adds these campaigns’ domains quickly.

The platforms whose videos link to fynvexes[.]com were advertised in 23 countries, from Italy and Argentina to Japan, Ghana and Canada. What they share is not the country or the language but the network distributing them.

Why it matters

• YouTube is the second step of the funnel. The celebrity ad creates the doubt; the “analysis” video settles it. People searching “is it legit?” find exactly what the scammers want them to find.
• The videos are ready before the victim is. Like reviews written in bulk and pages planted on hacked websites, the videos appear in the results as soon as a campaign starts.
• One link, a hundred platforms. Blocking a sign-up site achieves little if the redirector stays online. That is why each platform page (for example Ordalvek) now lists the redirect domains linked from its videos, when we find them.

How to spot one of these videos

1. Read the description before watching. If the first link says “official site” and is not the platform’s own domain, it is an affiliate or redirect link.
2. Be suspicious of a celebrity in the title. No journalist, presenter or politician “reviews” trading platforms with their name in front of the platform’s.
3. Look up the channel. If it posts near-identical videos about dozens of platforms, in several languages, within a few days, it is not an analyst: it is part of the network.
4. Check the platform with your country’s regulator, not on YouTube. Here is how to check whether a broker is regulated.

If you come across one of these videos, you can report it on YouTube from the video menu (Report › Spam or misleading › Scams or fraud). If you have already signed up or paid, follow these steps.

Method and limitations

• We searched Google Videos for the exact name of 184 platforms on 3 November 2026 and reviewed the first ten results for each. The figures are therefore a minimum.
• We counted a video as promotional when its description links to a redirect domain or to a website of the platform itself. We did not open the videos or follow the links.
• Registration dates come from public WHOIS lookups on 3 November 2026.
• A channel having posted a video about a platform does not mean its original owner knows it is being used this way: some channels appear to have been bought or stolen.

Are you a journalist or security researcher who would like the full list of videos and domains? Contact us.