# PhishDestroy domain threat record: aurextradeai.cash

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/aurextradeai.cash/
Machine-readable companion: https://phishdestroy.io/domain/aurextradeai.cash/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 05:23:36 UTC
- Last availability or vendor check: 2026-10-22 05:23:36 UTC
- Stored record updated: 2026-10-22 06:30:30 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: celer

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-08-17 11:20:54 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1620f-49fd-703f-b850-18c94ec26964/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/aurextradeai.cash
- Certificate Transparency search: https://crt.sh/?q=%25.aurextradeai.cash
- Web Archive lookup: https://web.archive.org/web/*/https://aurextradeai.cash/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added aurextradeai.cash to its internal blocklist on 2026-10-22 after a VirusTotal scan returned twelve malicious vendor detections. The recorded page title advertises a modern trading platform with AI tools, but no malicious behavior was directly observed on the page. An HTTP 200 response was recorded on the same date, confirming the site was reachable at that time. The domain first appeared in PhishDestroy’s logs on 2026-10-22.

How the scam works
Although no specific technique was observed, domains that present themselves as crypto‑trading services often aim to harvest login credentials or persuade visitors to deposit funds into fraudulent wallets. Such fake‑exchange schemes typically display professional‑looking interfaces, collect personal data, and may later request cryptocurrency transfers under the guise of investment or trading fees. The risk classification therefore reflects the generic threat posed by counterfeit trading sites.

Evidence
VirusTotal reported twelve malicious and three suspicious detections out of ninety‑two engines on 2026-10-22, with vendors including BitDefender, Fortinet, G‑Data and others labeling the domain as phishing or malicious. Google Safe Browsing checked the site on 2026-10-22 and did not flag it. URLScan captured the site twice: a 2026-09-08 scan returned a clean verdict, while a 2026-10-22 scan showed engine scores of 99 and a malicious tag, though the overall verdict was non‑malicious. OTX listed four pulses referencing the domain as of 2026-10-22. PhishDestroy’s own blocklist marks the domain as internal, and Cloudflare Radar flagged it for malware on 2026-10-22.

Infrastructure
The domain was registered on 2026-08-17 through Dynadot Inc, giving it an age of sixty‑five days at the time of observation. DNS records point to Cloudflare nameservers and resolve to IP addresses in the Cloudflare network (188.114.97.3 and 172.67.216.7). The TLS certificate, issued by Google Trust Services on 2026-10-15, is valid until 2027-01-13 and covers both the apex domain and subdomains. No DNSSEC signatures were present.

What to do
Visitors should avoid entering any credentials, personal information or cryptocurrency on this site; if they have already done so, they should change affected passwords and monitor associated accounts for unauthorized activity. Organizations should block aurextradeai.cash at the DNS or proxy level, review logs for any connections to the recorded IPs, and apply standard phishing‑mitigation policies to this exact domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1620f-49fd-703f-b850-18c94ec26964/
Cloudflare Radar report: https://radar.cloudflare.com/scan/9d662f68-d4fb-4d39-a780-93e04693e57e
URLQuery report: https://urlquery.net/report/3fee6e07-ac71-4acf-b764-1fff9ab75726
Stored capture screenshot: https://i.ibb.co/gFc0Wshy/c2650e46bf1a.png
Cloudflare Radar screenshot (2026-10-22T05:56:04Z): https://screenshots.phishdestroy.io/cf/9d662f68-d4fb-4d39-a780-93e04693e57e.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/3fee6e07-ac71-4acf-b764-1fff9ab75726.png
URLScan screenshot (2026-09-07T08:30:30Z): https://screenshots.phishdestroy.io/us/01a07afd-6b42-739d-8eb4-0a6f7f9eb52f.png
URLScan capture report: https://urlscan.io/result/01a07afd-6b42-739d-8eb4-0a6f7f9eb52f/
URLScan screenshot (2026-09-07T10:26:14Z): https://screenshots.phishdestroy.io/us/01a07b67-5c5e-77ec-9229-955c6ac6b663.png
URLScan capture report: https://urlscan.io/result/01a07b67-5c5e-77ec-9229-955c6ac6b663/
URLScan screenshot (2026-09-08T09:47:34Z): https://screenshots.phishdestroy.io/us/01a0806a-558b-76e0-b231-c81af6179f31.png
URLScan capture report: https://urlscan.io/result/01a0806a-558b-76e0-b231-c81af6179f31/
URLScan screenshot (2026-10-22T05:33:00Z): https://screenshots.phishdestroy.io/us/01a16219-18c6-7361-90b5-281b4184e70c.png
URLScan capture report: https://urlscan.io/result/01a16219-18c6-7361-90b5-281b4184e70c/
VirusTotal report: https://www.virustotal.com/gui/domain/aurextradeai.cash
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aurextradeai.cash
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 05:58:28 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gFc0Wshy/c2650e46bf1a.png
  Captured: 2026-10-22 05:23:36 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1620f-49fd-703f-b850-18c94ec26964.png
  Captured: 2026-10-22 05:23:36 UTC
  Source report: https://urlscan.io/result/01a1620f-49fd-703f-b850-18c94ec26964/
- URLScan capture 2: https://urlscan.io/screenshots/01a0806a-558b-76e0-b231-c81af6179f31.png
  Captured: 2026-10-22 05:16:02 UTC
  Source report: https://urlscan.io/result/01a1620f-49fd-703f-b850-18c94ec26964/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9d662f68-d4fb-4d39-a780-93e04693e57e.png
  Captured: 2026-10-22 05:56:04 UTC
  Source report: https://radar.cloudflare.com/scan/9d662f68-d4fb-4d39-a780-93e04693e57e
  SHA-256: 12623a3f85575669a9a33c44555b553cf214626f0390f5e17d04a5a87532ed2a
- URLQuery: https://screenshots.phishdestroy.io/uq/3fee6e07-ac71-4acf-b764-1fff9ab75726.png
  Source report: https://urlquery.net/report/3fee6e07-ac71-4acf-b764-1fff9ab75726
  SHA-256: a17ef5075eb8f9973dde0fc26f3156d8a0930b36507d784354c0ef207ab1b6ab
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07afd-6b42-739d-8eb4-0a6f7f9eb52f.png
  Captured: 2026-09-07 08:30:30 UTC
  Source report: https://urlscan.io/result/01a07afd-6b42-739d-8eb4-0a6f7f9eb52f/
  SHA-256: c430bfa687df8df023238aabeed26b606d77f6221f6a17a8c5ead9a1f6c9b497
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07b67-5c5e-77ec-9229-955c6ac6b663.png
  Captured: 2026-09-07 10:26:14 UTC
  Source report: https://urlscan.io/result/01a07b67-5c5e-77ec-9229-955c6ac6b663/
  SHA-256: 33f35fec1151b0070db85bd8ca158f31fb0a91a3a6995beb630d1afe226015cb
- URLScan · 2026-09-08: https://screenshots.phishdestroy.io/us/01a0806a-558b-76e0-b231-c81af6179f31.png
  Captured: 2026-09-08 09:47:34 UTC
  Source report: https://urlscan.io/result/01a0806a-558b-76e0-b231-c81af6179f31/
  SHA-256: 12e8c2024ede3528ba996261db35da74e6dd174c7efee0b83f42da2ba37e3bd9
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16219-18c6-7361-90b5-281b4184e70c.png
  Captured: 2026-10-22 05:33:00 UTC
  Source report: https://urlscan.io/result/01a16219-18c6-7361-90b5-281b4184e70c/
  SHA-256: 59896fffb145edb3c68a99056f315a26091af118d804cba50459b3903ac17fab

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T05:55:36Z",
        "uuid": "01a1620f-49fd-703f-b850-18c94ec26964",
        "scanned_at": "2026-10-22T05:22:20Z",
        "final_url": "https://aurextradeai.cash/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://aurextradeai.cash/",
                "from": "http://aurextradeai.cash/",
                "status": 307
            }
        ],
        "ip": "172.67.216.7",
        "domains": [
            "cdn.jsdelivr.net",
            "cdnjs.cloudflare.com",
            "modernroomdesigns.com",
            "static.cloudflareinsights.com",
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "104.21.38.110",
            "104.16.80.73",
            "172.217.222.94",
            "104.17.24.14",
            "104.17.207.5",
            "173.194.114.95",
            "172.67.216.7"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "a0b608b703e8e3a6f445295a533017e3b8a6e77b234dc69f86751c1f18635389",
        "script_hashes": [
            "4082edfaa0f4837bfa6ea5de436af8c395b7f6c65db26b87d2978143aab01885"
        ],
        "globals": [
            "polylang",
            "_language",
            "_phone_error",
            "_form_unknown_error",
            "_leadContactFocusInit",
            "__offerChatWidgetMounted",
            "intlTelInput",
            "__cfBeacon"
        ],
        "cookies": [
            "_subid",
            "csrftoken"
        ],
        "storage_keys": [
            "open-ai-design-5-chat-profile:aurextradeai.cash"
        ],
        "tls": {
            "san": [
                "aurextradeai.cash",
                "*.aurextradeai.cash"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "aurextradeai.cash",
            "protocol": "QUIC",
            "valid_to": "2027-01-13T17:46:59Z",
            "valid_from": "2026-10-15T16:49:16Z"
        },
        "domain_age_days": 65,
        "apex_age_days": 65,
        "tls_age_days": 6,
        "tls_valid_days": 90,
        "requests": 26,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T05:57:45Z",
        "uuid": "9d662f68-d4fb-4d39-a780-93e04693e57e",
        "scanned_at": "2026-10-22T05:56:04Z",
        "final_url": "https://aurextradeai.cash/",
        "status": 200,
        "history": [
            {
                "url": "https://aurextradeai.cash/",
                "status": 200
            }
        ],
        "dom_hash": "e5e926477980e663a6e8391dfcc82df0dba4713c1eaa051d3ab7715cc0b5cbae",
        "doc_hash": "30a227b08fc0f7ebc2de8905ea6349c008494f98f1b1be072963746346c7f9f2",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "aurextradeai.cash",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "aurextradeai.cash",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "aurextradeai.cash",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "aurextradeai.cash",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T05:55:45Z",
        "analysis_at": "2026-10-19T18:44:57Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 12,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-08-17T13:46:35Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "harvey.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "harvey.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.216.7"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kira.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:d807"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:3de2"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.61.226"
            }
        ],
        "dns_at": "2026-10-19T18:50:13Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "aurextradeai.cash",
                "*.aurextradeai.cash"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "56bd26334f3950f50e8d99deaa45f7e1",
            "sha256": "dd311f108b6fbe05019a9856c51b5012df6c6f6636d92ff81819b6e4c7797943",
            "subject": "aurextradeai.cash",
            "valid_to": "2027-01-13T17:46:59Z",
            "valid_from": "2026-10-15T16:49:16Z"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-08-17T13:20:54Z",
                "last changed": "2026-08-17T13:21:02Z",
                "registration": "2026-08-17T13:20:54Z",
                "registrar expiration": "2027-08-17T13:20:54Z",
                "last update of RDAP database": "2026-10-16T07:33:02Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T05:57:59Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "aurextradeai.cash"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-22T05:18:51Z",
            "first": "2026-10-07T16:20:54Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.07,
            "avg_page_bytes": 49389
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://aurextradeai.cash/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 7
        },
        "social_tags": {
            "ogUrl": "https://aurextradeai.cash/",
            "title": "Aurex Trade AI Official Platform 2026 | Plateforme de Trading avec Outils d'Analyse Professionnels",
            "ogType": "website",
            "robots": "index, follow, max-image-preview:large, max-snippet:-1",
            "ogImage": "https://aurextradeai.cash/_media/094275452badca8b1091/og-share-1200x630.jpg",
            "ogTitle": "Aurex Trade AI Official Platform 2026 | Plateforme de Trading avec Outils d'Analyse Professionnels",
            "ogSiteName": "Aurex Trade AI",
            "themeColor": "#0c1222",
            "description": "Aurex Trade AI propose une plateforme de trading moderne intégrant des données de marché en temps réel, des graphiques interactifs, des outils d'analyse avancés et une interface intuitive conçue pour offrir une expérience de trading fluide et performante.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://aurextradeai.cash/",
            "ogDescription": "Aurex Trade AI propose une plateforme de trading moderne intégrant des données de marché en temps réel, des graphiques interactifs, des outils d'analyse avancés et une interface intuitive conçue pour offrir une expérience de trading fluide et performante."
        },
        "trackers": {
            "requests": 13,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/intl-tel-input@23.0.12/build/js/intlTelInput.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 10,
                "wait": 382,
                "connect": 16,
                "download": 14
            },
            "response_ms": 424
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 167171,
            "co2_grams": 0.0061,
            "cleaner_than": 11
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.35.152",
                    "host": "harvey.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.197",
                    "host": "kira.ns.cloudflare.com"
                }
            ],
            "zone": "aurextradeai.cash"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "_subid",
                    "session": true
                },
                {
                    "name": "csrftoken",
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3120::9",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "aurextradeai.cash"
        },
        "dns": {
            "A": [
                "188.114.96.9",
                "188.114.97.9"
            ],
            "NS": [
                "harvey.ns.cloudflare.com",
                "kira.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"harvey.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417572270, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::9",
                "2a06:98c1:3121::9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "DENY",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://aurextradeai.cash"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Python",
                "Django",
                "jsDelivr",
                "Google Font API",
                "cdnjs",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 15
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "x-frame-options": "DENY",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```