# PhishDestroy domain threat record: ardoviaxmarkets.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/ardoviaxmarkets.com/ Machine-readable companion: https://phishdestroy.io/domain/ardoviaxmarkets.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-04 15:50:41 UTC - Last availability or vendor check: 2026-10-21 01:14:00 UTC - Stored record updated: 2026-10-22 14:20:54 UTC - VirusTotal detections in the stored snapshot: 11/90 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 104.21.60.106 - Registrar in stored WHOIS data: Realtime Register B.V. - Registrar country in stored WHOIS data: Unknown - Registration date (registry RDAP, ardoviaxmarkets.com): 2026-07-08 08:55:52 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a06d1b-dd53-709c-8885-c07680d5170b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ardoviaxmarkets.com - Certificate Transparency search: https://crt.sh/?q=%25.ardoviaxmarkets.com - Web Archive lookup: https://web.archive.org/web/*/https://ardoviaxmarkets.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview ardoviaxmarkets.com presented itself as "Ardovex Markets Ltd", a trading-firm identity aimed at people looking to invest or trade crypto. The domain spelling "ardoviax" does not even match the "Ardovex" name on the page, a mismatch typical of throwaway impersonation sites. PhishDestroy first flagged it on 2026-09-04. The site has been offline since 2026-09-11, its DNS no longer resolves, and it was still dead when rechecked on 2026-10-19. How the scam works Impersonation pages like this borrow a company-style name and the polish of a regulated broker so visitors trust it with money or credentials. Typical flows ask the victim to register, then deposit crypto into a trading account that never really exists, or to connect a wallet and sign transactions presented as account verification. Balances shown on the dashboard are fiction. Victims lose whatever they deposit, any login details they reuse elsewhere, and in wallet-connect variants, the assets those signatures unlock. Evidence Eleven of 90 VirusTotal engines flagged the domain as of 2026-09-06, including BitDefender, Kaspersky, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, CRDF and alphaMountain.ai. That is a modest count, but it comes from established vendors. More telling, MetaMask and SEAL both list it alongside PhishDestroy, which means wallet users were warned at the browser-extension level. Four AlienVault OTX threat pulses also reference it. Infrastructure The domain was registered on 2026-07-08 through Realtime Register B.V., about eight weeks before PhishDestroy caught it. That gap suggests a site set up in advance and promoted quietly before detection. It sat behind Cloudflare, with the edge address geolocated to Canada, so the real origin server was hidden from view. The Google Trust Services certificate gave it a browser padlock, which proves nothing about who ran it. It went dark within a week of being flagged. What to do If you deposited funds with "Ardovex Markets", treat the money as at risk and do not pay any "withdrawal fee", tax or unlock charge, because these schemes use such demands to extract more. If you connected a wallet or signed anything on the site, revoke token approvals with a reputable approval checker and move remaining assets to a fresh wallet. If you created an account, change that password wherever you reused it and enable 2FA. Report losses to your local cybercrime unit and the exchange you sent funds from. Defenders should block the domain and look for similarly spelled "markets" lookalikes registered in the same period. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a06d1b-dd53-709c-8885-c07680d5170b/ VirusTotal report: https://www.virustotal.com/gui/domain/ardoviaxmarkets.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ardoviaxmarkets.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:23:08 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Jh3Ppvq/7a0d24213ff6.png Captured: 2026-09-04 15:50:41 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a06d1b-dd53-709c-8885-c07680d5170b.png Captured: 2026-09-04 15:50:41 UTC Source report: https://urlscan.io/result/01a06d1b-dd53-709c-8885-c07680d5170b/ - URLQuery: https://screenshots.phishdestroy.io/uq/55706ea5-4af5-44b0-b03d-8268f16866e8.png Captured: 2026-09-04 15:53:19 UTC Source report: https://urlquery.net/report/55706ea5-4af5-44b0-b03d-8268f16866e8 SHA-256: 2dd9153a238c589bc4897927f4322c4ad7a713138e7bd66a29fceb77eed712c8 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/97fdfd04-5804-4c40-b9ed-10995c317a49.png Captured: 2026-09-04 16:25:03 UTC Source report: https://radar.cloudflare.com/scan/97fdfd04-5804-4c40-b9ed-10995c317a49 SHA-256: 3d84aaf84f0533436558a85545b1e52dbfea29cf52b66bce9f12bffa6b899e72 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06d16-76e8-7110-b1aa-329dfd740176.png Captured: 2026-09-04 15:43:11 UTC Source report: https://urlscan.io/result/01a06d16-76e8-7110-b1aa-329dfd740176/ SHA-256: 3ab7cbde4bcbcf11751caa668d20cc270f417c1e2ea578d254cc7ff0f73de542 - URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07aaa-154e-7494-bd8f-9749e8f78b27.png Captured: 2026-09-07 06:59:29 UTC Source report: https://urlscan.io/result/01a07aaa-154e-7494-bd8f-9749e8f78b27/ SHA-256: 0e64f90e0aebd8e7dcf755f8284e66e848b83da5b0ed1a640828c491d6ddd5b8 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:51:54Z", "uuid": "01a06d1b-dd53-709c-8885-c07680d5170b", "scanned_at": "2026-09-04T15:49:05Z", "final_url": "https://ardoviaxmarkets.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://ardoviaxmarkets.com/", "from": "http://ardoviaxmarkets.com/", "status": 307 } ], "ip": "172.67.195.201", "domains": [ "widget.trustpilot.com", "cdn.gtranslate.net", "www.gomarkets.com" ], "ips": [ "52.222.236.60", "104.26.12.42", "172.67.195.201" ], "asns": [ "16509", "13335" ], "countries": [ "US" ], "link_domains": [ "user.ardoviaxmarkets.com", "direct.lc.chat", "au.trustpilot.com" ], "doc_hash": "d4604e28ae2a8ad9d636046f371d2dd76113698be2265912f7f1a60007e6e701", "script_hashes": [ "cb87b52d551751a0523962c542cfa0ea266230241f82c5cbbb5ecf493b01f57e", "a04d00d3b27734f2a543608b394e3bf8633372f2b02cbe7b6ddb105a5b0b8faf", "ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b", "594121a3efc691e6489aefae468b66b48eacacf31e53dff2feb38dd6f16cffab", "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "a564e781937714f4b20e73b186efa18707a956d3102749244d97154e7a2d1c19", "d8d273362c341048e6488de095c4cc7e320cca3a53cc9af548ae2f573017953f", "c14ace72eec34f5390dfca45a55b3e15ae7930840ff8193f0b469e7db6284e92", "3436e3402cc74ce6abd0e034b69072141ef931266070c69a85987df179f51085", "0afba7d24433ee673fb0b2716854747aee7163815620c5cafc0bf3af154a03bb" ], "globals": [ "__VUE_INSTANCE_SETTERS__", "__VUE_SSR_SETTERS__", "__VUE__" ], "tls": { "san": [ "ardoviaxmarkets.com", "*.ardoviaxmarkets.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "ardoviaxmarkets.com", "protocol": "QUIC", "valid_to": "2026-10-06T09:01:13Z", "valid_from": "2026-07-08T08:03:59Z" }, "domain_age_days": 58, "apex_age_days": 58, "tls_age_days": 58, "tls_valid_days": 90, "requests": 65, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:02:04Z", "uuid": "97fdfd04-5804-4c40-b9ed-10995c317a49", "scanned_at": "2026-09-04T16:25:03Z", "final_url": "https://ardoviaxmarkets.com/", "status": 200, "history": [ { "url": "https://ardoviaxmarkets.com/", "status": 200 } ], "dom_hash": "958ad757ca4c69eb61a9ec6dee674169367719210522a3bbe3de9f0c5fcf3613", "doc_hash": "d5d3a507bc6bb9b5abb55f7d87240a9b538c2a3bb06cae6648b9f0060edcc785", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ardoviaxmarkets.com", "type": "A", "value": "104.21.60.106" }, { "name": "ardoviaxmarkets.com", "type": "A", "value": "172.67.195.201" }, { "name": "ardoviaxmarkets.com", "type": "AAAA", "value": "2606:4700:3033::6815:3c6a" }, { "name": "ardoviaxmarkets.com", "type": "AAAA", "value": "2606:4700:3032::ac43:c3c9" } ], "dnssec_valid": false, "ip": "104.21.60.106", "whois": { "registrar": "Realtime Register B.V.", "created": "2026-07-08T08:55:52Z", "updated": "2026-07-08T09:00:47Z", "expires": "2027-07-08T08:55:52Z", "nameservers": [ "cesar.ns.cloudflare.com", "ingrid.ns.cloudflare.com" ] } } } ```