# PhishDestroy domain threat record: aoh5pc.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/aoh5pc.com/ Machine-readable companion: https://phishdestroy.io/domain/aoh5pc.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 03:30:24 UTC - Last availability or vendor check: 2026-10-24 03:33:35 UTC - Stored record updated: 2026-10-24 04:45:02 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: morpho ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date (registry RDAP, aoh5pc.com): 2024-02-28 09:27:34 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16bf7-af8f-7496-96c7-3ed03a38a8d0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/aoh5pc.com - Certificate Transparency search: https://crt.sh/?q=%25.aoh5pc.com - Web Archive lookup: https://web.archive.org/web/*/https://aoh5pc.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified aoh5pc.com as malicious because the recorded page claimed to be Ave.ai and promoted a “Tokenized‑Stock Trading Contest” promising up to 20,000 USDT per person. The page title was recorded as “Ave.ai” and the excerpt read “The AVE Tokenized‑Stock Trading Contest is heating up…”. The domain was first seen by PhishDestroy on 2026-10-24 and returned an HTTP 200 response at that time. How the scam works In this category of fraud the attacker copies the branding of a legitimate crypto service and advertises a contest or investment that appears to reward participants in stablecoins. Victims are lured into connecting a wallet or sending funds, after which the promised rewards never materialize and any approved transactions can be drained. Evidence VirusTotal scanned the domain on 2026-10-24 and reported two detections: one malicious (CRDF) and one suspicious (Gridinsoft) out of 92 engines. Google Safe Browsing checked the same day and did not flag the URL. External blocklists MetaMask and SEAL listed the domain, and PhishDestroy’s internal list also marks it as malicious. A urlscan.io capture on 2026-10-20 gave an overall clean verdict while its machine‑learning engine assigned a malicious score of 78 and added urlscan‑ml tags. OTX reported zero pulses for the domain. Infrastructure The domain resolved to IP 188.114.97.3, a Cloudflare‑served address associated with GB, and the TLS certificate issued by Google Trust Services was valid from 2026-10-02 to 2026-12-31. Registration information shows the domain was created on 2024-02-28 with Dynadot Inc, giving it an age of 969 days at first sight. What to do Users should avoid interacting with the site or connecting any cryptocurrency wallet; if credentials were entered, change the associated passwords immediately. Defenders should block aoh5pc.com at the network perimeter, monitor DNS queries for the domain and its recorded IP, and add the domain to internal blocklists. Regularly review access logs for any unexpected requests to this address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16bf7-af8f-7496-96c7-3ed03a38a8d0/ Cloudflare Radar report: https://radar.cloudflare.com/scan/b60d6840-4403-4f84-9e92-cd94596b7f7d Stored capture screenshot: https://i.ibb.co/xKf3MCtX/5776fc1d2f3b.png Cloudflare Radar screenshot (2026-10-24T03:32:04Z): https://screenshots.phishdestroy.io/cf/b60d6840-4403-4f84-9e92-cd94596b7f7d.png VirusTotal report: https://www.virustotal.com/gui/domain/aoh5pc.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aoh5pc.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 03:34:49 UTC ## Stored page captures - Primary capture: https://i.ibb.co/xKf3MCtX/5776fc1d2f3b.png Captured: 2026-10-24 03:33:35 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16bf7-af8f-7496-96c7-3ed03a38a8d0.png Captured: 2026-10-24 03:33:35 UTC Source report: https://urlscan.io/result/01a16bf7-af8f-7496-96c7-3ed03a38a8d0/ - URLScan capture 2: https://urlscan.io/screenshots/01a15836-5f98-766e-8baa-3eaff244b776.png Captured: 2026-10-24 03:30:24 UTC Source report: https://urlscan.io/result/01a16bf7-af8f-7496-96c7-3ed03a38a8d0/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b60d6840-4403-4f84-9e92-cd94596b7f7d.png Captured: 2026-10-24 03:32:04 UTC Source report: https://radar.cloudflare.com/scan/b60d6840-4403-4f84-9e92-cd94596b7f7d SHA-256: 76273a2bf00ab4f2c435063fe420de3b850f746e9e727271cbc2015e19fdd7bd - URLQuery: https://screenshots.phishdestroy.io/uq/bae82fb9-5a75-4ff6-8432-3c413c44d02c.png Source report: https://urlquery.net/report/bae82fb9-5a75-4ff6-8432-3c413c44d02c SHA-256: 61cbc43bcfcd7a4de8a38f0147e94a732a0eb7603d5ecf4bd25560e7121c4906 - URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11c1d-d0d8-775b-9868-4d34e04fce0b.png Captured: 2026-10-08 15:25:02 UTC Source report: https://urlscan.io/result/01a11c1d-d0d8-775b-9868-4d34e04fce0b/ SHA-256: c24c1d742efbf99ce494ad1437e428f4ae9878655fdf4f4b613ead82f2b9b090 - URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11d75-2c43-755f-8660-0952488907a9.png Captured: 2026-10-08 21:39:51 UTC Source report: https://urlscan.io/result/01a11d75-2c43-755f-8660-0952488907a9/ SHA-256: dd67e4bb403a3d03e70469f438e1be22d07e7c8b9e501c0687fc9f6e49cfd702 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14399-aa28-755d-a598-3eab3eeff20e.png Captured: 2026-10-16 07:25:27 UTC Source report: https://urlscan.io/result/01a14399-aa28-755d-a598-3eab3eeff20e/ SHA-256: b6a20844165ddc5976730fb75f0ce35fb97bdc53e3357b69dab3c1c64673f1b6 - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15836-5f98-766e-8baa-3eaff244b776.png Captured: 2026-10-20 07:29:13 UTC Source report: https://urlscan.io/result/01a15836-5f98-766e-8baa-3eaff244b776/ SHA-256: 05e2692d6ffefc8368b84ebbf1e484dcecfc14660cd3199c441d55bdbb5e4172 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T03:33:47Z", "uuid": "01a16bf7-af8f-7496-96c7-3ed03a38a8d0", "scanned_at": "2026-10-24T03:32:57Z", "final_url": "https://m.aoh5pc.com/", "status": 200, "redirected": "parent-domain", "redirects": [ { "to": "https://aoh5pc.com/", "from": "http://aoh5pc.com/", "status": 307 }, { "to": "https://m.aoh5pc.com/", "from": "https://aoh5pc.com/" } ], "ip": "188.114.97.3", "domains": [ "aoh5pc.com", "dingquanyu.com", "www.iconaves.com", "api.gameanalytics.com", "aveipcheck.xyz", "region1.google-analytics.com", "ft367.com", "primpom.com", "szjyph.com", "fonts.googleapis.com", "www.googletagmanager.com", "www.avestorage.cloud", "yiyulu.com" ], "ips": [ "18.244.18.52", "32.193.167.144", "172.67.199.232", "43.174.251.230", "216.239.32.36", "142.251.20.95", "142.251.20.97", "188.114.97.3" ], "asns": [ "16509", "14618", "13335", "139341", "15169" ], "countries": [ "US", "SG" ], "link_domains": [ "download.ave-android.com", "apps.apple.com", "docs.avedex.cc" ], "doc_hash": "f42de648994936a99995aaf3384b15c304ed78ecb21b350b6f4d7fb2a79f3de3", "script_hashes": [ "3f47cf0e33e9734aa1d6249e3833de980d9c4ab03fc965130c3d29f28c71990e", "a58f9d0fa803a08cff35128f2820596ba7b2406b9e1980dc8290c8beb002b20e", "d2569ebd443511c7d7ee0bf1c05a5ec61eeb6535c5bc9396c99270ade909ec51", "7de27865ffd20680b6ebc2a451d999f32c0a5bbedb8737676f5c4f5f8779541b", "ffa35b2c9b640353e3ba058d49e3d7c7101b6f723b4a5eb2647791ba4c5bb495", "792664a64c8a1022e2219bbc7c7e775f6c8a581abec86015bdfc7ebcf0c14406", "b018f06ac9607fc67c5041eb31ff8fc637b1607b712b4a69a09698d189b6d822", "2206ea7ec49282c052d7971ff9eef977cd366a4bc43f79b438b5ab3de5098e73", "c5e6a115f139681d44cf64c679dd580b4bf271142d317ec344337c62f2b6e677", "47a9c689d1b9dc7602a689b2db830eece60fec474645c5909cc156c87bc244c6" ], "globals": [ "a0_0x2f72", "a0_0x4c8b", "vemachine", "antiClickjack", "redirect", "google_tag_data", "google_tag_manager", "dataLayer", "gtag", "onYouTubeIframeAPIReady", "gaGlobal", "webpackJsonp", "regeneratorRuntime", "__vueuse_ssr_handlers__", "__INTLIFY_PROD_DEVTOOLS__", "__VUE_I18N_FULL_INSTALL__", "__VUE_I18N_LEGACY_API__", "__VUE_I18N_PROD_DEVTOOLS__", "_ethers", "_", "_iconfont_svg_string_2554733", "__VUE__", "WKWVJBCallbacks", "__VUE_DEVTOOLS_PLUGINS__", "gameanalytics", "GameAnalytics" ], "cookies": [ "_ga", "_ga_LFKW8KRD0V", "ave_token", "refCode" ], "storage_keys": [ "perp_accessToken", "ave-kline-hint", "device_id", "botSwapSelectedWallets", "token_show_left", "token_show_right", "token_pairAddress", "token_selectedToken", "bog_mnemonic", "showBotMnemonicPhrase", "pageLoadTime", "pump_activeChain19", "language", "app-theme", "app-skin" ], "tls": { "san": [ "aoh5pc.com", "*.aoh5pc.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "aoh5pc.com", "protocol": "QUIC", "valid_to": "2026-12-31T02:59:50Z", "valid_from": "2026-10-02T02:01:00Z" }, "domain_age_days": 601, "apex_age_days": 968, "tls_age_days": 22, "tls_valid_days": 90, "requests": 445, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 78, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T03:33:49Z", "uuid": "b60d6840-4403-4f84-9e92-cd94596b7f7d", "scanned_at": "2026-10-24T03:32:04Z", "final_url": "https://aoh5pc.com/", "status": 200, "history": [ { "url": "https://aoh5pc.com/", "status": 200 } ], "dom_hash": "81072930802c6e8eff22dfa85f12e9009bd1a4bfb6fd980eae58b52e92a1ecc6", "doc_hash": "b950c70d8c71c562d20f9848daecaeb3fcabf0b3f9a3b0ad9cd1b5fbeca1c1f4", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "aoh5pc.com", "type": "A", "value": "188.114.97.0" }, { "name": "aoh5pc.com", "type": "A", "value": "188.114.96.0" }, { "name": "aoh5pc.com", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "aoh5pc.com", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "whois": { "registrar": "Dynadot Inc", "created": "2024-02-28T09:27:34Z", "updated": "2025-12-23T09:27:27Z", "expires": "2027-02-28T09:27:34Z", "nameservers": [ "bayan.ns.cloudflare.com", "jillian.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T03:31:21Z", "analysis_at": "2026-10-24T02:05:47Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 1, "undetected": 35 }, "detections": { "CRDF": "malicious", "Gridinsoft": "suspicious" }, "reputation": 0, "popularity": { "Cloudflare Radar": 1000000 }, "registrar": "Dynadot Inc", "created": "2024-02-28T09:27:34Z", "expires": "2027-02-28T09:27:34Z", "updated": "2025-12-23T09:27:27Z", "first_seen": "2024-03-01T08:10:35Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:2c65" }, { "ttl": 300, "type": "A", "value": "104.21.44.101" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:c689" }, { "ttl": 21600, "type": "NS", "value": "jillian.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "bayan.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.198.137" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "bayan.ns.cloudflare.com" } ], "dns_at": "2026-10-24T02:37:10Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "aoh5pc.com", "*.aoh5pc.com" ], "issuer": "Google Trust Services / WE1", "serial": "f1e8332b74d2c4e90e11d23acc28bd32", "sha256": "53037f9341324999d9615515e84b6ea20f6600bc92754975ce2ece6f981ecb26", "subject": "aoh5pc.com", "valid_to": "2026-12-31T02:59:50Z", "valid_from": "2026-10-02T02:01:00Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2024-02-28T09:27:34Z", "updated": "2025-12-23T09:27:27Z", "expires": "2027-02-28T09:27:34Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "bayan.ns.cloudflare.com", "jillian.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-02-28T09:27:34Z", "last changed": "2025-12-23T09:27:27Z", "registration": "2024-02-28T09:27:34Z", "registrar expiration": "2027-02-28T09:27:34Z", "last update of RDAP database": "2026-10-22T08:17:16Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T03:34:10Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "aoh5pc.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-24T03:31:06Z", "first": "2024-08-23T15:55:36Z", "changes": 19, "days_archived": 20, "scans_per_day": 0.02, "avg_page_bytes": 4390 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://ave.ai/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 20 }, "social_tags": { "ogUrl": "https://ave.ai", "title": "Ave.ai", "ogType": "website", "ogImage": "https://ave.s3.ap-east-1.amazonaws.com/logo/tg-share.png", "ogTitle": "Ave.ai - The Ultimate Web3 Trading Platform", "description": "Ave.ai is the most comprehensive on-chain crypto trading platform, integrating 130+ blockchains and 300+ DEXs...", "ogDescription": "Real-Time Blockchain Data, Price Alerts, Smart Money, KOL, Sniping, Copy-Trading and more." }, "trackers": { "requests": 161 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 14, "wait": 41, "connect": 10, "download": 0 }, "response_ms": 66 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 17566, "co2_grams": 0.0006, "cleaner_than": 60 }, "dns_server": { "ns": [ { "ip": "108.162.194.44", "host": "jillian.ns.cloudflare.com" }, { "ip": "173.245.59.72", "host": "bayan.ns.cloudflare.com" } ], "zone": "aoh5pc.com" }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "aoh5pc.com" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "NS": [ "jillian.ns.cloudflare.com", "bayan.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"bayan.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416395775, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3120::3", "2a06:98c1:3121::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://aoh5pc.com" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2024-02-28T09:27:34Z", "updated": "2025-12-23T09:27:27Z", "expires": "2027-02-28T09:27:34Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "bayan.ns.cloudflare.com", "jillian.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } } } } ```