25 warned investment websites with the same unusual set-up

What links them

Every website has name servers: the entries that tell a browser where to find the site. Most websites use the standard name servers of their host or registrar, which thousands of other customers share. These websites use private name servers with random-looking names, such as rt9ue7.com, qj5tk1.com and wn0vib.com, in two families: one set of three, and a second family whose two sets share their name servers. Among the firms we track whose name-server records we hold, no other website uses them.

The 25 websites named below were all registered through the French registrar NETIM SAS, between 9 November 2025 and 22 April 2026. Several of their names sound local to the country of the regulator that warned about them: fort-tresorique.com was warned about by Belgium’s FSMA, scherp-fondstad.com by the Dutch AFM, estable-corexis.com by Spain’s CNMV and fortunezza.com by Italy’s CONSOB.

They went offline together

Our monitoring saw 18 of these websites online on 20 September 2026. At our next check, on 26 September 2026, every one of them was offline, and none has come back since. 7 more were warned about later, and we never saw them online.

What this does and does not show

The same registrar, the same unusual kind of name servers and a shutdown between the same two checks are a rare combination. It suggests the websites were set up and run together, but it does not prove who runs them, and each regulator warned about each website on its own. 4 more websites use the same name servers. They appear in our data without a warning we could check, so we do not name them here.

The 25 websites