What happened
PhishDestroy posted on Mastodon on 12 November 2026 two related suspected scam domains, yeldunravu-norway[.]com (registered July 2026) and yeldunravu[.]shop (registered September 2026). Its records describe the first as a Norwegian-language crypto trading page with an account-registration form and market statistics, and the second as a landing page promoting AI-driven automated trading tools with a registration form. They were flagged by 16 and 14 of 92 VirusTotal engines respectively. Be wary of trading platforms advertised online that ask for your phone number to "open an account". The domains are also on the Phishing Army blocklist.
How the scam works
Unlicensed investment and 'AI trading' sites usually start with a polished sign-up form, a promised high or guaranteed return, and pressure to deposit quickly, often after a call or a message on Telegram. Early small withdrawals may be paid so that you send more. Clone firms copy the name, and sometimes the address or phone number, of a real authorised business. Check the firm on your national regulator's register, and type the official website yourself rather than following a link. A regulator warning or a block order is not a finding that a particular customer lost money; it is a notice that the site is not authorised to offer those services.
If a message, a page or a caller creates urgency about money, a login or a legal threat, pause and check the claim through a contact method you already trust. Keep screenshots, reference numbers and the exact addresses or phone numbers you were given, and tell your bank early if money has already left the account. Official brands and authorised firms named in a lure are not involved unless a primary source says otherwise.
Source
Source: https://mastodon.social/@phishdestroy/117603152431912668 (PhishDestroy (@phishdestroy@mastodon.social), Nov 12, 2026, 6:08 AM ET)
