Spain’s securities regulator has warned that four web addresses imitate MyInvestor, a licensed Spanish bank, so we tried to open every one of them and compared what we found.
Only one still shows a page, and it wears a copied logo, a company number that belongs to a different firm and a domain that is two months old.
Overview
What the Clone Sites Offer
We found a wealth management and trading pitch called My Investor, with five account tiers from $250 to $50,000 and a sign-in page headed Sign in to MyInvestor.
The real MyInvestor is a Spanish bank that writes in Spanish and invests from €1, so none of this matches the firm it copies.
Three of the four flagged hosts return a server error, the bare domains behind two of them show a Cloudflare phishing warning, and only one host still shows a page.
What the Checks Found
The regulator’s own list names all four addresses as clones with no relationship to MyInvestor Banco, S.A., and our checks of the working page agree with that description.
The footer gives company number 12780933, which Companies House lists as X Finance Ltd, a firm with an active proposal to strike it off the register.
The domain was registered on September 10, 2026, yet the footer claims copyright from 2023.
What We Could and Could Not Verify
Here is where the evidence stands after our checks:
- Verified by us: the regulator’s warning entries, the real bank’s register record, the domain dates, the footer company details, the page code and the live status of every host.
- Not found: any license, any real address for the operator, any mail setup, or any link between these sites and the real MyInvestor.
- Not verified: where deposits go, who operates the sites, and what happens after login. We did not register, sign in or pay.
Our advice is not to deposit anything, and the sections below explain how to reach the real bank and what to do if you already paid.
The Real MyInvestor Is a Spanish Bank
We began with the regulator, because it is the one document that names these addresses, and we wanted to read it ourselves instead of relying on a summary.
On the search page for warned companies at the Spanish regulator, the CNMV, we searched for myinvestor and received two dated entries.
The entry dated October 19, 2026 lists panel.myinvestor-ltd.com, app.myinvestor-limited.com and live.myinvestor-ltd.co, each marked as a clone.
A separate search for tairales returns a second entry with the same date, for app.tairales-ltd.org/profile-info, also marked as a clone.
The comment on each entry says the address has no relationship with MyInvestor Banco, S.A. That bank is registered in Spain as a credit institution, number 1,544.
An earlier entry dated July 27, 2026 names cfd.myinvestor.ltd and myinvestor.ltd, 84 days before the October warning. The regulator has flagged at least six addresses in three months.
We then opened the bank’s own record in the regulator’s register.
It lists MyInvestor Banco, S.A. among Spanish credit institutions with code 1544 and a registered office at Calle Columela 8, 28001 Madrid.
The bank’s website, myinvestor.es, is written in Spanish. Its home page offers 2.50% interest on cash for six months, investing from €1 and a risk scale from 1 to 6.
The same page says deposits are covered by the Spanish deposit guarantee fund up to €100,000 per holder, and it lists a Spanish phone number in the footer.
So the licensed bank is the victim of a borrowed name here. Nothing we read links it to any of the four addresses.
Four Hosts, One Working Page
We requested the front page of each named host from our server on November 12, 2026, with a plain request and no changes to our browser identity.
Three of the four answered with Cloudflare error 522, which means the network edge could not reach whatever server sits behind the name.
That covered panel.myinvestor-ltd.com, live.myinvestor-ltd.co and app.myinvestor-limited.com, the three hosts the regulator listed in its first entry.
Only app.tairales-ltd.org returned a real page, a sign-in screen for an app called Trading Platform that we describe below.
We also asked for the bare domains behind these hosts. myinvestor-ltd.com returned the same 522 error.
The domains myinvestor-limited.com and myinvestor-ltd.co each returned a Cloudflare warning page with the heading Suspected Phishing, 5 KB in size.
That page is Cloudflare’s own warning, not a block aimed at our tools, and it offers buttons to learn more, verify or ignore and proceed.
We did not click any of them, so we did not read what sits behind it, and we left the page alone.
The mismatch between the regulator’s host names and the working page matters. The only live content sits on a domain that does not contain the name MyInvestor at all.
The regulator still files it in the same group, because the sign-in page carries that name and logo.
Founded in 2023 on a Domain From September 2026
The working site is tairales-ltd.org, and its page title is My Investor, so we checked its dates against what its footer says.
The footer reads Copyright 2023-2026 and the company description talks about long-term wealth management, as if the firm had operated for years.
RDAP, the public registration database, shows the domain was registered on September 10, 2026 at 13:48 UTC through the registrar Tucows, with name servers at Cloudflare.
The certificate log lists the first security certificate for the name at 13:52 UTC, three minutes and 39 seconds after registration.
The home page file carries a last-modified time of 15:05 UTC that day, one hour and 17 minutes after registration. The sign-in app’s page followed at 15:07.
That timing fits a template uploaded within the first two hours of the domain’s life, not the 2023 start that the footer implies.
The regulator flagged the address 39 days later, on October 19, and when we checked on November 12 the domain was 63 days old.
The other flagged domains are similarly young. RDAP shows myinvestor-ltd.com registered on July 7, 2026 and myinvestor-limited.com on August 20, both through Tucows.
The registry for the .co domain would not answer our query, but the certificate log shows its first certificate on August 14, 2026.
At the time of the October warning the four domains were about 104, 66, 60 and 39 days old, so every one of them was younger than four months.
Testing the Account Pitch
The most concrete promise on the home page is its price list, so we read it line by line and did the arithmetic.
The page asks you to pick your trading account, with Standard at $250, Bronze at $5,000, Silver at $15,000, Gold at $25,000 and VIP at $50,000.
The top tier costs 200 times the entry tier, and one of each would cost $95,250 in total.
The real bank, by contrast, lets customers invest from €1, so even ignoring the exchange rate the clone’s entry price is about 250 times higher.
Standard and Bronze promise spreads from 1.2 pips, and Standard names MT4 and MT5. Those are currency trading terms, not the language of a Spanish savings bank.
We found no download link for either platform on the page. All five Open account buttons lead to the same sign-in address.
Silver, Gold and VIP carry exactly the same description, a premium account with exclusive benefits, minimal spreads, high-speed order execution and priority 24/7 support.
A genuine price ladder would explain what each step adds, and this one repeats a sentence three times.
The page copy shows the same carelessness elsewhere. The Risk Modeling and Diversification Strategy steps end with an identical sentence about a portfolio distributed across assets, sectors and geographies.
The wording about risk modeling therefore describes diversification, which suggests text pasted in place without being read.
The Trade View table lists six assets: Bitcoin, Ethereum, Binance Coin, Solana, USDC and XRP.
The page script fills it from the public price feed of the Binance exchange. It also keeps a fixed supply for each coin, such as 19,500,000 for Bitcoin.
So the table shows other people’s market prices. It is not evidence that the site trades, holds or offers any of those assets to clients.
A bank regulated in Spain describes funds and savings. This page sells crypto prices beside forex language, which is a different business from the one the logo implies.
A Leftover Brand and a Foreign Company Number
The contact section contains a sentence that we could not match to anything else on the page.
It praises the Swiss Vests Client Portal and an award-winning trading platform, and a stray backtick sits in the middle of the sentence.
The obvious domain, swissvests.com, has no registration record, and no award is named anywhere on the page.
The simplest explanation is a template written for another brand, with My Investor pasted over the old name in most places but not all.
That is an inference from the text, not something we can prove, and we do not know where the template came from.
The specialist team gets the same treatment. The page promises decades of experience in stock markets, real estate and venture capital, yet it names no one.
Inside the Sign-In App
The sign-in page at app.tairales-ltd.org is a single-page app, and we read its code as plain text without running anything or typing into any field.
The page title is a generic Trading Platform. The headline reads Sign in to MyInvestor, above a line asking you to make sure you are visiting the correct URL.
The address printed below that line is app.tairales-ltd.org, so the page tells a visitor to trust a domain that has nothing to do with MyInvestor.
The app bundle is 2.5 MB. The headline is a translated phrase, Sign in to, followed by a brand name that the code passes in as a typed value.
The same value picks a configuration folder holding the logo files. That is how white-label software behaves: one codebase can be given any brand name and logo.
The app sends its requests to a separate host, tulguard.com, with a login token. RDAP shows that domain was registered on November 21, 2025 through Tucows.
When we asked that host for its front page, it answered with an HTTP 401 unauthorized reply, and we sent nothing else to it.
The app text includes deposit options for card, bank transfer and crypto, with a note that USDT deposits on the TRON network arrive after 5 to 10 minutes.
It also has account labels MAIN, BRONZE, SILVER, GOLD, PLATINUM, VIP and CX, which do not match the five names on the price list.
The home page has no Platinum tier and calls its entry account Standard, so two parts of the same operation use different lists.
The app also holds translations in 21 languages, including Spanish, yet the page we reached was in English only.
How the Clone Pitch Works
Step 1: A familiar name and logo
A visitor sees a logo styled like the bank’s wordmark, with a red arrow inside the word, and the name My Investor on a dark, modern page.
Someone who has heard of MyInvestor in Spain could easily assume this is a new corporate site, especially when the sign-in page repeats the name.
Step 2: A wealth management story
The text promises strategy, security and growth, market scanning, risk modeling and diversification, and a team that stays with your strategy through regular briefings.
Each claim is generic. We found no performance figure, no fund name and no regulator mentioned on the page.
Step 3: A choice of account
The price list pushes you to pick a tier between $250 and $50,000, and every Open account button goes to the sign-in app.
The page offers no document, contract or terms link for any tier, so a visitor commits to a tier without seeing what it means.
Step 4: Sign-in and the deposit step
The sign-in screen offers Email and Mobile login and a Sign Up link, and the code behind it carries card, bank and crypto deposit options.
We stopped at the sign-in page, so we never saw the deposit instructions, the receiving accounts or any withdrawal rules.
Who Runs the MyInvestor Clones?
The company named in the documents
The page footer names no company. It gives only company number 12780933 and a registered office in Stanmore, England, with the line that all rights are reserved.
We looked the number up on the Companies House record, the UK’s public register, and it belongs to X Finance Ltd, not to My Investor.
That firm was incorporated on July 30, 2020, with business code 64301, activities of investment trusts, and the same registered office address as the footer.
Its status reads Active with an active proposal to strike off, and both its accounts and its confirmation statement are marked overdue.
Companies House says it does not check the accuracy of what companies file, and we make no claim about X Finance Ltd beyond what its record shows.
Where the address and registration lead
The record explains one thing: the footer borrows a real registration number and address, but those details belong to a company with a different name.
A visitor who searched for the number would find a firm that is overdue with its filings and proposed for removal, not a wealth manager with 2023 roots.
We cannot say whether X Finance Ltd knows about the page, whether its details were copied or provided, or whether it has any link to the sites.
The real bank’s register entry shows a Madrid address and a Spanish credit institution code, which share nothing with the footer or the UK number.
Domain, platform and reviews
The four hosts sit behind Cloudflare, and three of the domains we could read were registered through Tucows, which shows a common setup but not a common owner.
Each domain uses its own pair of Cloudflare name servers, so the name servers do not tie them together. We found no mail records on any of them.
The support address printed on the page is on tairales-ltd.org, and since that domain has no mail records, we could not tell where messages sent to it would go.
The page head carries no analytics or advertising identifiers, so the usual shared tracking trail between sister sites was not available to us.
We found no review, registry entry or independent record for My Investor under the tairales-ltd.org name.
What we could not confirm
We did not sign up, sign in, fill the contact form or call the phone number printed on the page, so we cannot describe what happens after contact.
We could not read what sits behind the Cloudflare warning on two of the domains, and the three hosts that returned 522 gave us no content at all.
We cannot say who operates the sites, whether the four addresses share an operator, or whether anyone has lost money to them.
What to Do If You Signed Up or Deposited
-
Do not deposit. A page that borrows a bank’s name, shows no license and gives another firm’s company number gives you nobody to hold responsible.
-
Use the real address. Type myinvestor.es yourself, or use the phone number in the footer of that site, and never follow a link from a message.
-
Check any firm yourself. Search the regulator’s warning list and its register of credit institutions before you send money to a name you do not know.
-
Change your passwords. If you typed an email and password on any of these addresses, change that password everywhere you reuse it, starting with your email account.
-
Save the evidence. Keep screenshots, the domain names, payment receipts, wallet addresses, transaction hashes and every message you exchanged with anyone who contacted you.
-
Call your bank at once. If you sent a transfer, give the bank the details and ask whether a recall is possible, because speed matters.
-
Dispute card payments. If a card was involved, send your issuer a dispute letter as soon as you can and keep a copy.
-
Report it. Tell your local police and the regulator in your country, file a report at ReportFraud.ftc.gov if you are in the US, and ignore anyone offering paid recovery.
Frequently Asked Questions
Is MyInvestor a scam?
No. The real MyInvestor is a Spanish bank in the regulator’s register. The sites we tested only borrow its name and logo.
Are these clone sites legit?
We would not trust them. The regulator lists them as clones, one is registered 63 days ago with a 2023 copyright, and its footer shows another company’s number.
Is tairales-ltd.org connected to MyInvestor?
We found no connection. The sign-in page uses the MyInvestor name and logo, but the domain, the company number and the support address all belong elsewhere.
Why do some of the flagged sites show errors?
Three returned a Cloudflare 522 error, meaning no server answered behind the name, and two show a phishing warning. We cannot say why, and the sites may return.
Does the 1,544 number on the warning mean anything?
It is the real bank’s code in the regulator’s register of Spanish credit institutions. The warning cites it to help people tell the genuine bank apart from the copies.
What if I already sent money?
Contact your bank or card issuer immediately, save every detail of the payment and report the domains. A crypto transfer cannot be reversed by the sender.
The Bottom Line
Do not send money to any site that uses the MyInvestor name outside myinvestor.es. The regulator flags four clones, and the working one borrows another firm’s company number.
If you want to invest with MyInvestor, open its own website by typing the address, and check any firm against the regulator’s register before you register.
If you already paid or entered a password, change your passwords, call your bank, save the evidence, and report the domains to the regulator and the police.
Join the discussion
0 commentsShare your experience or ask a question about this article.
Discussion
Start the conversation
Have a question or something useful to share? Add the first comment.