# PhishDestroy threat dossier — aerovest.live
================================================================

Fetched:   2026-07-27 05:34:40 UTC
Canonical: https://phishdestroy.io/domain/aerovest.live/

## VERDICT
----------------------------------------------------------------
CRITICAL THREAT — DO NOT VISIT
Composite threat score: 100/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      11/91 security vendors flagged this domain
  Flagging vendors: alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Fortinet, G-Data, Lionic, Netcraft, Sophos, VIPRE
URLQuery:        2 detections
AlienVault OTX:  3 pulses (threat-intel feed mentions)
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      86.107.77.158
Registrar:       GoDaddy.com, LLC
Nameservers:     ns13.netlightsystems.com, ns14.netlightsystems.com
Registered:      2025-11-28
Expires:         2026-11-28
Page title:      Aerovest|| Investment solutions designed with elegance and finesse

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     Let's Encrypt / YR2
Expires:    2026-08-29
Status:     INVALID chain
Fingerprint: 172af6d3de44226b1725c2d135991597acc489ea3f64028a6794f62bc35e3790

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2025-11-28 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-07-27 05:04:22 UTC (by PhishDestroy tracker)
First reported:    2026-07-27 03:33:38 UTC (abuse notice filed)
Last verified:     2026-07-27 06:50:43 UTC
Current status:    ACTIVE / observable

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019fa18b-e869-71ec-b7fa-c88beab3b4d0/
URLQuery:         https://urlquery.net/report/64c18fee-fda9-431e-9f2e-89eb123aa842
Wayback Machine:  https://web.archive.org/web/*/aerovest.live
crt.sh CT logs:   https://crt.sh/?q=%25.aerovest.live
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=aerovest.live
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/aerovest.live
URLhaus:          https://urlhaus.abuse.ch/host/aerovest.live/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-27 05:09:33 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

Aerovest.live Used for High‑Risk Generic Phishing Campaign

Analysis conducted on July 27, 2026 identifies aerovest.live as an active generic phishing infrastructure. The domain was created on November 28, 2025 and registered through GoDaddy.com, LLC. DNS resolution points to the IPv4 address 86.107.77.158, with authoritative name servers ns13.netlightsystems.com and ns14.netlightsystems.com. Reputation data shows the domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, indicating that at least one anti‑phishing service has taken mitigation action.

VirusTotal scans have returned 11 of 91 security vendors flagging the domain as malicious, providing a consistent signal of compromise across multiple detection engines. No public page title, SSL certificate details, HTTP status code, or Safe Browsing verdict are presently available, so the exact landing page content and transport security posture remain unknown. Defenders should prioritize immediate containment by adding aerovest.live to network‑level deny lists and updating proxy or firewall rules to block traffic to its resolving IP address 86.107.77.158.

Continuous monitoring of the associated name servers and the IP block for any new malicious activity is recommended, as is periodic re‑scanning with VirusTotal and other multi‑engine services to capture changes in detection rates. Given the registrar’s reputation and the active blocklist status, threat‑intel sharing with industry partners can help accelerate broader mitigation efforts.

## EVIDENCE HASHES
----------------------------------------------------------------
PhishDestroy Case ID:  PD-20260727-2FCC46
Favicon MD5:       835aad3b28af6fa6c14e5034802f7e6f
TLS cert SHA-256:      172af6d3de44226b1725c2d135991597acc489ea3f64028a6794f62bc35e3790

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/aerovest.live/
JSON API:          https://api.destroy.tools/v1/check?domain=aerovest.live
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 202,849 domains (78,271 alive under monitoring, 123,547 confirmed takedowns/dead). Site: https://phishdestroy.io