# PhishDestroy domain threat record: apoyvex.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/apoyvex.shop/
Machine-readable companion: https://phishdestroy.io/domain/apoyvex.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-21 20:49:09 UTC
- Last availability or vendor check: 2026-10-21 23:04:07 UTC
- Stored record updated: 2026-10-21 23:04:07 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: celer

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-05-19 08:19:20 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16037-bd83-70dd-bed8-5c6e05c669af/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/apoyvex.shop
- Certificate Transparency search: https://crt.sh/?q=%25.apoyvex.shop
- Web Archive lookup: https://web.archive.org/web/*/https://apoyvex.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed apoyvex.shop as a suspicious domain. The recorded page title is “ApoyVex | AI Trading Platform | Official Website”. PhishDestroy first observed the domain on 2026-10-21, and an HTTP 200 response was recorded on that date.

How the scam works
The listing reflects a general risk that the site could be used to lure visitors into providing credentials or financial information by advertising an AI‑driven trading service. No concrete evidence of credential‑harvesting forms, wallet requests, or malware delivery was captured in the available snapshots. The assessment therefore treats the domain as potentially deceptive without attributing a specific fraud technique.

Evidence
VirusTotal scanned the domain on 2026-10-19 and reported 14 malicious and 3 suspicious detections out of 92 engines, tagging it as phishing and dga. Google Safe Browsing checked the domain on 2026-10-21 and did not flag it. URLScan captured a clean verdict on 2026-08-04 and a later scan on 2026-10-21 that received a malicious engine score of 95 with urlscan‑ml tags. OTX listed four pulses referencing the domain as of 2026-10-21, PhishDestroy’s internal blocklist marks the domain as listed, and external blocklists showed zero matches on the check date.

Infrastructure
The domain was registered on 2026-05-19 through Spaceship, Inc., giving it an age of 155 days at the time of first observation. DNS records captured on 2026-10-19 resolved to Cloudflare A and AAAA addresses, and the recorded IP address was 188.114.97.3 belonging to CloudFLARENET‑EU in Great Britain. TLS was issued by Google Trust Services, valid from 2026-09-15 to 2026-12-14, and the site presented standard security headers and a Cloudflare web application firewall. The server header recorded was “cloudflare” and the site used HSTS and a content‑security‑policy.

What to do
Visitors should avoid entering credentials, personal data, or financial information on the site; if any such data was submitted, change associated passwords and monitor accounts for unusual activity. Security teams can add the domain and its recorded IP address to blocklists, monitor outbound traffic for connections to the listed Cloudflare IPs, and review web server logs for any requests to apoyvex.shop.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16037-bd83-70dd-bed8-5c6e05c669af/
Stored capture screenshot: https://urlscan.io/screenshots/01a16037-bd83-70dd-bed8-5c6e05c669af.png
URLScan screenshot (2026-08-03T11:15:32Z): https://screenshots.phishdestroy.io/us/019fc755-f1f4-7379-8298-82a51e89b14d.png
URLScan capture report: https://urlscan.io/result/019fc755-f1f4-7379-8298-82a51e89b14d/
URLScan screenshot (2026-08-04T07:49:57Z): https://screenshots.phishdestroy.io/us/019fcbc0-1670-727e-86a9-891de4e63ccc.png
URLScan capture report: https://urlscan.io/result/019fcbc0-1670-727e-86a9-891de4e63ccc/
URLScan screenshot (2026-10-21T20:56:06Z): https://screenshots.phishdestroy.io/us/01a1603f-bd29-769a-a2a0-b54a26bfab81.png
URLScan capture report: https://urlscan.io/result/01a1603f-bd29-769a-a2a0-b54a26bfab81/
VirusTotal report: https://www.virustotal.com/gui/domain/apoyvex.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=apoyvex.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-21 21:22:25 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16037-bd83-70dd-bed8-5c6e05c669af.png
  Captured: 2026-10-21 20:49:09 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a16037-bd83-70dd-bed8-5c6e05c669af.png
  Captured: 2026-10-21 20:49:09 UTC
  Source report: https://urlscan.io/result/01a16037-bd83-70dd-bed8-5c6e05c669af/
- URLScan capture 2: https://urlscan.io/screenshots/019fcbc0-1670-727e-86a9-891de4e63ccc.png
  Captured: 2026-10-21 20:44:26 UTC
  Source report: https://urlscan.io/result/01a16037-bd83-70dd-bed8-5c6e05c669af/
- URLScan · 2026-08-03: https://screenshots.phishdestroy.io/us/019fc755-f1f4-7379-8298-82a51e89b14d.png
  Captured: 2026-08-03 11:15:32 UTC
  Source report: https://urlscan.io/result/019fc755-f1f4-7379-8298-82a51e89b14d/
  SHA-256: d492a481ac24c489cf8a6aa0509e16b404f0d376597d127eef368df813c8abd9
- URLScan · 2026-08-04: https://screenshots.phishdestroy.io/us/019fcbc0-1670-727e-86a9-891de4e63ccc.png
  Captured: 2026-08-04 07:49:57 UTC
  Source report: https://urlscan.io/result/019fcbc0-1670-727e-86a9-891de4e63ccc/
  SHA-256: 21089833a7077c4ca4ce9c383a853a1caed67a51ef8b21c0b742803f3fd7037b
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a1603f-bd29-769a-a2a0-b54a26bfab81.png
  Captured: 2026-10-21 20:56:06 UTC
  Source report: https://urlscan.io/result/01a1603f-bd29-769a-a2a0-b54a26bfab81/
  SHA-256: 624ccf6e24df0782b5cb4c6ad2cee7aeddad003075eec80458dc05ec10d6705a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T21:16:19Z",
        "uuid": "01a16037-bd83-70dd-bed8-5c6e05c669af",
        "scanned_at": "2026-10-21T20:47:18Z",
        "final_url": "https://apoyvex.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://apoyvex.shop/",
                "from": "http://apoyvex.shop/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "cdnjs.cloudflare.com",
            "challenges.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "104.18.94.41",
            "2a04:4e42:600::485",
            "2a00:1450:4001:c0f::5f",
            "104.17.25.14",
            "188.114.96.3"
        ],
        "asns": [
            "13335",
            "54113",
            "15169"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "746aa8725ad1a1aae06e71e3bc1448f147f6ef3df5d135c1efa90dc6240d0325",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_s7s6o2",
            "toggleTermsPopup",
            "__tsGet",
            "__tsNeedsClick",
            "__tsShow",
            "__tsReset",
            "__lgBS",
            "__cfQR",
            "turnstile",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "apoyvex.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "apoyvex.shop",
            "protocol": "QUIC",
            "valid_to": "2026-12-14T18:34:19Z",
            "valid_from": "2026-09-15T17:34:23Z"
        },
        "domain_age_days": 155,
        "apex_age_days": 155,
        "tls_age_days": 36,
        "tls_valid_days": 90,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; img-src 'self' data: blob:; default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T21:19:47Z",
        "analysis_at": "2026-10-19T11:54:21Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-05-19T14:39:56Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:301f"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "andy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.176.108"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "andy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.48.31"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "fay.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:b06c"
            }
        ],
        "dns_at": "2026-10-19T11:59:38Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "apoyvex.shop"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "333bf391a5547fdf0e42d4da1970a6d5",
            "sha256": "a85b2705d2d4ee62e90000d94660669de693f481ad36a56cdf0e0e7050a45e2f",
            "subject": "apoyvex.shop",
            "valid_to": "2026-12-14T18:34:19Z",
            "valid_from": "2026-09-15T17:34:23Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-21T21:21:47Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "apoyvex.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://apoyvex.shop/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://apoyvex.shop/",
            "title": "ApoyVex | AI Trading Platform | Official Website",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "ApoyVex | Elite AI-Driven Trading Workflow",
            "ogSiteName": "ApoyVex",
            "themeColor": "#000000",
            "description": "ApoyVex delivers a premium, AI-enhanced trading workspace featuring intelligent guidance, automated bots, execution controls, and risk-aware configurations for active market participants.",
            "twitterCard": "summary",
            "canonicalUrl": "https://apoyvex.shop/",
            "ogDescription": "ApoyVex delivers a premium, AI-enhanced trading workspace featuring intelligent guidance, automated bots, execution controls, and risk-aware configurations for active market participants."
        },
        "trackers": {
            "requests": 17,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 7
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1,
                "tls": 16,
                "wait": 112,
                "connect": 8,
                "download": 12
            },
            "response_ms": 149
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 151389,
            "co2_grams": 0.0055,
            "cleaner_than": 13
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.59.101",
                    "host": "andy.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.32.115",
                    "host": "fay.ns.cloudflare.com"
                }
            ],
            "zone": "apoyvex.shop"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3120::9",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "apoyvex.shop"
        },
        "dns": {
            "A": [
                "188.114.96.9",
                "188.114.97.9"
            ],
            "NS": [
                "andy.ns.cloudflare.com",
                "fay.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"andy.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418085209, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::9",
                "2a06:98c1:3121::9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; img-src 'self' data: blob:; default",
            "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://apoyvex.shop"
            ]
        },
        "tech_stack": {
            "technologies": [
                "jsDelivr",
                "Cloudflare Turnstile",
                "Cloudflare Rocket Loader",
                "ClientJS",
                "Priority Hints",
                "Google Font API",
                "Font Awesome",
                "cdnjs",
                "HSTS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 15
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
                "content-security-policy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; img-src 'self' data: blob:; default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; fra",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```