ABUSE NOTICE · 7D+ OPEN Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.

Notification and current-status evidence

The sent-report ledger records the first outgoing report at 2026-03-18 18:43:55 UTC. The recorded recipient is u-abue@ultahost.com. The latest stored availability evidence still shows the domain reachable; 5 months has elapsed since the first outgoing report.

ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.

Elapsed since first report

5 months

Reports sent

Latest case ID

PD-20260318-67ADF2

Current status

Observed active at latest stored check

Domain security and threat intelligence

mql5[.]software

“MQL5 Forex: Expert Advisors & Automated Trading Bots for MT4/MT5”

Threat verdict Critical 86/100 evidence score

Availability Unverified Current reachability is unverified

Risk signals

VirusTotal detections: 12/91 Scam type: Investment Scam

Mar 18, 2026 1 Report Sent CDN

Evidence Summary

CRITICAL

The domain mql5.software was a generic phishing site posing as an investment scam related to forex trading and automated bots for MT4/MT5 platforms. It did not impersonate a specific legitimate brand but used the MQL5 name to deceive users into believing it offered expert advisors or trading tools. The site has since been taken offline, but it previously presented an elevated risk of financial fraud or credential theft.

Technical indicators show mql5.software was flagged by 2 of 95 VirusTotal security vendors and appeared on 1 security blocklist (PhishDestroy). The domain was registered through Ultahost, Inc on June 05, 2024, and resolved to the IP address 82.41.181.74, located in the United Kingdom. It used Cloudflare nameservers (ignacio.ns.cloudflare.com and ivy.ns.cloudflare.com) and had an SSL certificate issued by Let's Encrypt. The observed page title was 'MQL5 Forex: Expert Advisors & Automated Trading Bots for MT4/MT5,' and technologies detected included Node.js, Ubuntu, React, Nginx, Next.js, Google Analytics, and Webpack. Gridinsoft assigned it a trust score of 0/100.

Users who interacted with mql5.software should monitor their accounts for unauthorized transactions, particularly if financial or login credentials were entered. Change passwords for any accounts accessed through the site and enable two-factor authentication where available. Report the domain to relevant authorities or platforms, such as the registrar (Ultahost, Inc), Google Safe Browsing, or local cybercrime units. If cryptocurrency was involved, review wallet approvals and consider moving funds to a new wallet to prevent further exposure.

VirusTotal

12 det.

URLScan

Report ↗

TLS Certificate

Let's Encrypt

Age

2.2 yr

Observed status

Unverified

DestroyList

Listed

Reports Sent

Data coverage VirusTotal 12 / 91 URLQuery checked — no detections recorded PhishStats checked — no match recorded OTX no community references CF Radar scan completed URLScan capture stored report URLScan verdict verdict unavailable DNS blocks 14 checked — no blocks TLS valid certificate, 52d WHOIS 27 mo old Screenshot 3 captures · 3 sources Redirect chain not probed

Threat Response Pipeline

Discovery

Checks

Reports

Availability

9/10

Public Blocklist Status

Stored Capture

Screenshot of mql5.software — **URLScan capture**2026-07-29 02:48 UTC 2 / 3

View Full Size Source Report Wayback Download

Page Title

MQL5 Forex: Expert Advisors & Automated Trading Bots for MT4/MT5

TLS Certificate

Valid transport encryption · Issued by Let's Encrypt · valid for 52 days

Domain Intelligence

Domain

Telegram IoCs 6 extracted https://t.me/yoforexrobot https://t.me/YoForexAsia/ https://t.me/+t4vLn-yl8mcxYTU1

Server / ASN nginx/1.18.0 (Ubuntu) · AS214036 Ultahost, Inc.

IP Context CDN shared edge origin IP hidden Edge-IP reputation is not attributed to this domain.

Registrar Ultahost

ICANN RegistryOfficial ICANN accredited-registrars →

WHOIS LookupICANN RDAP for mql5.software →

IP Address 82.41.181.74 CDN

Geo

Airdrie, GB

NetworkAS214036 · Ultahost, Inc.

Reverse IPviewdns.info → rapiddns.io →

The origin IP is hidden behind a CDN proxy. Reverse-IP results for the edge address contain unrelated tenants; finding the origin requires passive DNS or certificate-transparency data.

RegistrationCreated Jun 5, 2024

Elapsed Since First Report 35 days

What we count Raw elapsed time since the first stored abuse report. It is not a registrar response-time measurement. Latest observed status: Unverified.

What each report contains Stored outgoing-report records may reference evidence available at the time, such as vendor verdicts, registration data, hosting details, classifications, or screenshots. This page does not infer the exact payload delivered, receipt, acknowledgement, or action by a recipient.

Technical detailsDNS, SSL SANs, timestamps

First DetectedMar 18, 2026

IoC Extractionscanned Jul 29, 20260 wallet · 6 Telegram IoCs

Submitted URLhttps://mql5.software/

Nameserversignacio.ns.cloudflare.comivy.ns.cloudflare.com

Favicon Hash

Case ID

ICANN OVERSIGHT

Accreditation and RAA context

Registrar accreditation and DNS abuse obligations

For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.

Accreditation is a contract, not a safety certification.

RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.

Accreditation is a contract, not a safety seal. Verify ICANN fees Read RAA §3.18 PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight

Accountability draft Nothing is sent automatically.

Technologies · 7 identified

Node.js

Programming languages

JavaScript runtime built on Chrome V8 engine for server-side development.

Ubuntu

React

JavaScript frameworks

JavaScript library for building user interfaces with component-based architecture.

Nginx

Web servers Reverse proxies

High-performance HTTP server and reverse proxy, known for stability and low resource usage.

Next.js

JavaScript frameworks SSR

React framework for production with hybrid static and server rendering.

Google Analytics

Analytics

Web analytics service tracking website traffic and user behavior.

marketingplatform.google.com

Webpack

Build tools

Module bundler for modern JavaScript applications.

Detected via Cloudflare Radar · Wappalyzer engine

Report This Domain Submit evidence & help protect others

VirusTotal Analysis

12 / 91 security vendors flagged this domain

View on VT

Last analyzed 2026-08-12 04:23:41 UTC Previous stored snapshot: 13 detections

ADMINUSLabs

alphaMountain.ai

BitDefender

Chong Lua Dao

ESET

Fortinet

G-Data

Gridinsoft

Lionic

SafeToOpen

Sophos

VIPRE

Site Performance Analysis

Google PageSpeed Insights — mobile performance audit of mql5.software · checked Mar 18, 2026

Poor

Performance

FCP

5.04s

First Contentful Paint

LCP

6.29s

Largest Contentful Paint

CLS

0.781

Cumulative Layout Shift

TBT

232ms

Total Blocking Time

5.04s

Speed Index

Evidence & External Reports

Security Analysis

URLScan Stored capture VirusTotal 12 det. ChainPatrol URLQuery Analyzed Gridinsoft SSL Labs Stored TLS valid CF Radar Open report WOT ScamAdviser Blacklist Checker URLVoid Sucuri SiteCheck MDN Observatory

Submitted Evidence Snapshot

Sent: 2026-03-18 18:43:55 UTC Ledger records: 1 Case ID: PD-20260318-67ADF2 Recipient: u-abue@ultahost.com

Page title stored with report: MQL5 Forex: Expert Advisors & Automated Trading Bots for MT4/MT5

URLScan evidence VirusTotal evidence URLQuery evidence Screenshot 1,928.8 KB

OSINT & Intelligence

Web-Check Full scan SOCRadar Dark web report LeakIX Leak search Shodan Censys ThreatFox Hudson Rock Sign-in search IntelX crt.sh Certs WHOIS Wayback

DNS & Network

nslookup.io DNS bgp.tools ASN/Route

SEO & Domain

SpyFu Moz DA/PA Ahrefs Backlinks Deep Analysis

Were You Affected by This Site?

If credentials were compromised, report immediately. Do not engage with recovery scammers.

If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.

FBI IC3

Report internet-enabled crime in the United States

Federal tips line1-800-CALL-FBI

Europol

Find the official reporting channel for your EU country

National police directory

Action Fraud

Report fraud and cybercrime in England, Wales and Northern Ireland

Contact centre0300 123 2040

PhishDestroy listing review Not a law-enforcement report

Domain Appeal

Request a review if you own this domain and believe the listing is incorrect

Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →

Report to Your Local Authorities

Select your country to get official cybercrime contacts, or create a complaint draft →.

97-country directory

Template-based draft • optional AI wording assistance requires separate consent Review and submit it yourself

Stay Informed, Stay Safe

Monitor live threats or contest this listing if you believe it's a false positive

Live Threat Feed Appeal This Listing

HTML · IFRAME

Embed This Report

Share this threat intelligence on your website or blog

embed.html

<iframe
  src="https://phishdestroy.io/embed/domain/mql5.software"
  title="PhishDestroy threat report for mql5.software"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>

mql5[.]software

Threat Response Pipeline

Public Blocklist Status

Stored Capture