What happened
PhishDestroy posted on Mastodon on 12 November 2026 a series of suspected scam domains that, according to its domain records, all show "AI trading platform" pages with account-registration forms collecting names, emails and phone numbers: zedarontrader-2ai[.]com ("Zedaron Trader 2"), zeltixaipro[.]com ("Zeltix Ai"), yieldarioai[.]click, xoven-aisoft[.]com ("XOVEN AI"), zentrax-nova-tech[.]com ("Zentrax Nova"), zenitdexeris[.]online ("Alkotás Fintrix"), xixochain[.]pro ("XixoChain") and zentari-system[.]shop ("Zentari"). All eight resolve to addresses in 185.62.57.x and 185.62.58.x, were flagged by 15 to 17 of 92 VirusTotal engines, and are on the Phishing Army blocklist. Sign-up pages like these are often used to pass contact details to callers who push deposits into unregulated trading accounts. Check that any investment firm is licensed with your national regulator before handing over details.
How the scam works
Unlicensed investment and 'AI trading' sites usually start with a polished sign-up form, a promised high or guaranteed return, and pressure to deposit quickly, often after a call or a message on Telegram. Early small withdrawals may be paid so that you send more. Clone firms copy the name, and sometimes the address or phone number, of a real authorised business. Check the firm on your national regulator's register, and type the official website yourself rather than following a link. A regulator warning or a block order is not a finding that a particular customer lost money; it is a notice that the site is not authorised to offer those services.
If a message, a page or a caller creates urgency about money, a login or a legal threat, pause and check the claim through a contact method you already trust. Keep screenshots, reference numbers and the exact addresses or phone numbers you were given, and tell your bank early if money has already left the account. Official brands and authorised firms named in a lure are not involved unless a primary source says otherwise.
Source
Source: https://mastodon.social/@phishdestroy/117603817883599503 (PhishDestroy (@phishdestroy@mastodon.social), Nov 12, 2026, 8:57 AM ET)
