Evidence verified October 30, 2026

ASIC-warned “CX Investment” sites keep dying — and re-registering

This is a public evidence page from Scam Detective’s published research. The real entity is CX Investment Pty Ltd — ACN 625 945 397, ABN 49 625 945 397, registered May 3, 2018 — and it operates no website of its own. ASIC has formally warned about two “CX Investment” impersonation domains (July 28 and October 23, 2026); both are dead today. That is the finding, not the consolation: an operation that re-registers the name after every warning means the risk is the rotation, not any single domain a takedown could kill. And because the genuine company has no website, the consumer test is unusually clean — match the website, not just the name: any “CX Investment” trading site you can visit is borrowing the name, because the real company has none. Every finding is backed by the independent sources listed further down the page.

3
Lookalike domains found
High
Overall risk level
6
Independent corroborating sources
October 30, 2026
Case verified
The evidence

Confirmed lookalike domains

High riskASIC-warned clone — exact-name domain on .com

cx-investment.com

Registration profileRegistered May 6, 2026 via Namecheap, with an Iceland-based registrant — weeks old when ASIC’s warning landed; NXDOMAIN now
First seenJuly 28, 2026, in ASIC’s impersonation warning
Evidence
  • Formally warned about by ASIC as an impersonation scam (July 28, 2026) — a regulator’s public notice, not a scanner opinion.
  • Registered May 6, 2026 via Namecheap with an Iceland-based registrant — a weeks-old, offshore registration wearing an Australian company’s name.
  • NXDOMAIN now — dead, like the rest of the warned set. The rotation had already moved on.
High riskASIC-warned clone — “webtrader” subdomain on .io

webtrader.cx-investment.io

Registration profileSubdomain of cx-investment.io, deployed on the “webtrader.” pattern fake platforms use to imitate institutional trading terminals; NXDOMAIN now
First seenOctober 23, 2026, in ASIC’s impersonation warning
Evidence
  • Formally warned about by ASIC as an impersonation scam (October 23, 2026) — the second ASIC warning on this name in under three months, documenting the rotation in real time.
  • ASIC’s warning listed the operation’s scam contacts: [email protected] (itself NXDOMAIN now), phone 61748032040, and an Epping NSW 2121 address — contact details that migrate across domains as each one burns.
  • NXDOMAIN now — the second ASIC-warned domain in this set to die. Both warned domains dead, and the name still circulating: the rotation, not the domains, is the threat.
High riskLive same-name-family site — separately corroborated

cix-investment.net

Registration profileRegistered September 9, 2025 via NameSilo, with the registrant redacted under GB privacy — a 13.5-month-old domain presenting as an established platform
First seenLive at verification (October 30, 2026); corroborated by an October 30 romance-scam case
Evidence
  • Live at verification — the surviving member of the name family, one letter transposed from the ASIC-warned names.
  • Corroborated by an October 30, 2026 romance-scam case: the victim claimed two years of investing on a domain that is 13.5 months old — a timeline the WHOIS record flatly contradicts, which is the tell.
  • Framed honestly: this is the same name-family, separately corroborated — the evidence does not establish that cix-investment.net shares an operator with the ASIC-warned domains, and this page does not claim it. Regulators have flagged sibling names independently (see the corroboration section), which is why it is listed.
Pattern watchlist — not yet independently confirmed

cix-investment.com — A sibling name formally warned about by the Central Bank of Russia — a regulator-flagged member of the same name-family, not independently confirmed active at verification, and not asserted to share an operator with any other domain in this set.

The pattern

Red flags in this clone rotation

  1. 01Match the website, not just the name — the real CX Investment Pty Ltd (ACN 625 945 397, ABN 49 625 945 397, registered May 3, 2018) operates no website at all. Any “CX Investment” or near-name trading site you can visit is borrowing the name; there is no genuine site for it to be.
  2. 02The rotation is the threat — both ASIC-warned domains (cx-investment.com, webtrader.cx-investment.io) are dead, and ASIC’s own contact list for the operation already points at a third (cx-investment.net, also dead). An operation that re-registers after every warning cannot be defeated by checking one domain against one blacklist.
  3. 03Contact details outlive domains — ASIC listed the operation’s support email, phone (61748032040), and an Epping NSW 2121 address. Scam operations keep the phone number and move the website; verify a platform’s registration, not whether its phone number matches one on a warning.
  4. 04The age-versus-claim test — the corroborated October 30 romance-scam case claimed two years of investing on cix-investment.net, a domain registered September 9, 2025. When a platform’s claimed history exceeds its domain’s age by a year, the claim is the scam.
  5. 05The “webtrader.” subdomain pattern — fake platforms deploy on webtrader.<lookalike> to imitate institutional trading terminals. A real broker’s web terminal sits on its own registered domain, reachable from the firm’s homepage.
  6. 06A multi-regulator trail — ASIC has warned twice on this name (July 28 and October 23, 2026, via the Moneysmart investor alert list / IOSCO I-SCAN warnings 55540 and 57721), the Central Bank of Russia has warned on sibling cix-investment.com, and the UK FCA has flagged a clone firm under the adjacent “CIX Markets” name. When three regulators have flagged a name family, assume the family is larger than the warnings.
Independent confirmation

Who corroborates this evidence

ASIC Moneysmart investor alert list (IOSCO I-SCAN warnings 55540 and 57721)

Australia’s corporate regulator formally warned about cx-investment.com (July 28, 2026) and webtrader.cx-investment.io (October 23, 2026) as impersonation scams — two regulator notices documenting the rotation, including the operation’s listed contacts ([email protected], phone 61748032040, Epping NSW 2121).

Central Bank of Russia

The Bank of Russia has issued its own warning on sibling cix-investment.com — a second regulator independently flagging the same name-family.

UK Financial Conduct Authority

The FCA has flagged a clone firm under the adjacent “CIX Markets” name — a third jurisdiction’s regulator warning on the CIX/CX name family.

ASIC business register

The real entity’s record — CX Investment Pty Ltd, ACN 625 945 397, ABN 49 625 945 397, registered May 3, 2018 — establishes that the genuine company has no official website, which is what makes the match-the-website test decisive here.

scam.com.au weekly brief (October 26, 2026)

Independent Australian scam-reporting coverage of the ASIC warnings — corroborating the rotation beyond the regulator’s own list.

WHOIS record and corroborated victim case (October 30, 2026)

cix-investment.net’s WHOIS shows a September 9, 2025 registration via NameSilo with a GB-redacted registrant — 13.5 months old at verification — while the corroborated October 30 romance-scam case claimed two years of investing on it.

Full investigative write-up: Romance Scam — Red Flags and How to Protect Yourself.

See exactly what you get

The audit, opened up

Findings · Risk ratings · Takedown template

Below is an abbreviated sample from a real audit format — the same report structure every $29 audit follows. The brand and domains shown are an illustrative example; your audit researches the company name and official domain you enter and documents what it finds the same way.

Sample — from a real audit format
Report date: March 14
Brand impersonation audit
Harborline Supply Co.
Official domain: harborlinesupply.com · 6 findings (5 shown) · 2 High · 2 Medium · 1 Low
Findings — lookalike domains
DomainTypeRiskEvidence
harborline-supply.comFake storefrontHighFull copy of the official site — same logo placement, layout, and product photography. Checkout collects card details before account creation. Registered 9 days ago behind a privacy proxy.
harborl1nesupply.comTyposquatHighDigit-for-letter swap ("1" for "l"). Redirect chain lands on a replica storefront with a cloned login form. SSL certificate issued 4 days after registration.
harborlinesupply-outlet.shopFake outletMediumPoses as a discount outlet channel. No affiliation disclosed anywhere on the site; the footer copies Harborline's legal text verbatim.
getharborlinesupply.comLookalikeMediumRoutes brand-name search traffic to a survey-with-prize flow before offering any products. Registered in the same bulk batch as the fake storefront above.
harborlinesupply.shopLookalikeLowBrand-name domain, currently parked with no active checkout. Rated Low and flagged for a re-check in 30 days in case it activates.

+ 1 more finding in the full report, documented the same way. Report summary: active impersonation campaign — act on the two High-risk domains first.

Takedown-request template — excerpt
Subject: Takedown request — <lookalike-domain> To the Abuse Team at <registrar / hosting provider>, I am writing on behalf of Harborline Supply Co., owner of the trademark HARBORLINE SUPPLY and the official website harborlinesupply.com. The domain <lookalike-domain>, registered through your service on <registration date>, impersonates our brand to deceive our customers: 1. Copies our logo, site layout, and product photography 2. Operates a checkout that collects visitors' card details 3. Discloses no affiliation with our company We request the immediate suspension of <lookalike-domain> …

The full template ships pre-filled with your brand, your official domain, and each finding's evidence — one per high-risk domain, ready to send to its registrar or host.

Your $29 audit follows this exact format for your company — every lookalike, typosquat, and copycat store found, each with its evidence and risk rating, plus the takedown template. Delivered instantly after checkout.

One-time payment

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29
Questions about this evidence, or need it for a takedown request? Email [email protected].
Not ready to buy?

Get the free CX Investment impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.

Other brand evidence pages
Corkcicle →StoneX →Fidelity →Owala →BrüMate →MrBeast →USPS →LEGO →AMLBot →Amazon →Huawei →Daniel Wellington →SodaStream →CurrentBody →Dreame →Grubhub →TikTok Shop →Ooni →Simple Modern →Vessi →Swig Life →Barefoot Dreams →Midsummer Agency →Grow & Convert →Wordibly →Labrys →Arctoris →Staffology by IRIS →KeenLogic →Dotinum →Vosyn →OpenSea →Merkle →THE OUTNET →Jelurida →Xeno →The Nexus Project →CoinGate →TechSolutions Group →Foundation Devices →Dave’s Hot Chicken →MCM Securities →All evidence pages