premiumforexgoal.org posed as a trading platform offering "Reliable and Profitable Investment in Binary Options, Forex, Indices, CFD's". It was aimed at people looking for high-return online investments. PhishDestroy first saw it on 2026-09-07 and classified it as an impersonation phishing page. The site went offline on 2026-09-11, and on 2026-10-19 it was still dead with no active DNS. The page title shows an investment platform, and we classified it as impersonation phishing.
How the scam works
Sites like this copy the look and language of a legitimate brokerage, with dashboards, profit charts and promises of steady returns, so the visitor believes they are opening a real trading account. Victims are pushed to deposit money, often in crypto. Their balance then appears to grow on screen. When they try to withdraw, new "fees", "taxes" or "verification deposits" are demanded, and the money never comes back. Sign-up forms can also collect identity documents, email addresses and passwords that are later reused against the victim.
Evidence
When VirusTotal checked the domain on 2026-09-08, 4 of 89 engines flagged it: Gridinsoft, Netcraft, SOCRadar and desenmascara.me. That is a low count, but it came within a day of our own detection and from vendors that specialise in fraud and phishing. The domain also appears in 4 AlienVault OTX threat pulses, so other researchers tracked it independently. PhishDestroy lists it on our blocklist.
Infrastructure
The domain was registered through NAMECHEAP INC on 2026-09-05, just two days before we detected it. It stopped resolving six days after registration. A fresh domain that is used briefly and then dropped is typical of investment-fraud operations that rotate through disposable sites. Hosting was on the PONYNET network of FranTech Solutions, a US provider, with the server located in Luxembourg.
What to do
If you deposited money on premiumforexgoal.org, stop all further payments. Any request for a "withdrawal fee" or "unlock deposit" is part of the scam. Contact your bank or card issuer right away to dispute the transfers, and keep screenshots, chat logs and transaction IDs for a police or financial-regulator report. If you sent crypto, report the transaction to the exchange you sent it from. If you uploaded ID documents, watch for identity misuse, and change any password you reused on the site. Be wary of "recovery services" that contact you afterwards, because they are often run by the same scammers. Defenders should block the domain and IP 198.251.84.200 and watch for newly registered lookalike forex domains that use the same page title.
DOM Analysisanalyzed 2026年9月7日score 96/1002 brand signals
Submitted URLhttps://premiumforexgoal.org/
Favicon Hash
ケース ID
Observed page title
premiumforexgoal | Reliable and Profitable Investment in Binary Options, Forex, Indices, CFD's
Automated brand references
GoogleWhatsApp
TLS証明書
発行者 YR2
Network & certificates
Stored technical evidence
Network & DNS
Resolved IP
198.251.84.200
Network ASN
AS53667
Organization
PONYNET - FranTech Solutions, US
Observed location
Luxembourg, LU
Server header
LiteSpeed
ネームサーバー 2
ns5.my-control-panel.com
ns6.my-control-panel.com
Location describes the IP network.
TLS証明書
Issuer
YR2
Collection source
PhishDestroy collector
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeDNS 非アクティブreason: DNS NXDOMAIN80% confidence
Attributionsource: Dns Cache
Evidence layersAvailability: DNS inactiveContent: UnreachableDNS: NXDOMAINRegistration: Unknown
Latest HTTP observation不明Probe Inconclusive20%2026-10-19 01:14:18 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-09-06 23:03:27 UTCcurrent episode first observed: 2026-09-30 16:14:55 UTCobserved RIP window: 2026-09-06 23:03:27 UTC → 2026-09-30 16:14:55 UTC · 569.19hmidpoint estimate ≈ 2026-09-18 19:39:11 UTC · precision low · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(IS)
