# PhishDestroy threat dossier — pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net ================================================================ Fetched: 2026-06-28 12:38:56 UTC Canonical: https://phishdestroy.io/domain/pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Aave ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Flagging vendors: Forcepoint ThreatSeeker, LevelBlue, Phishing Database URLQuery: 2 detections Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- Registrar: NameCheap, Inc. Nameservers: ["aurora.ns.cloudflare.com", "nitin.ns.cloudflare.com"] Page title: Loading… HTTP response: 451 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-06-09 05:41:42 UTC (by PhishDestroy tracker) First reported: 2026-06-07 00:20:47 UTC (abuse notice filed) Last verified: 2026-06-28 12:20:35 UTC Neutralised: 2026-06-11 03:46:09 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e9f69-b7c5-71fa-a3e2-5abe260140e8/ URLQuery: https://urlquery.net/report/abc9d11a-399b-4af5-a696-bb1120c7556d Wayback Machine: https://web.archive.org/web/*/pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net crt.sh CT logs: https://crt.sh/?q=%25.pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net AlienVault OTX: https://otx.alienvault.com/indicator/domain/pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net URLhaus: https://urlhaus.abuse.ch/host/pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-26 02:14:55 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain is flagged as an elevated-risk brand impersonation threat targeting Aave, a decentralized finance protocol. The infrastructure is designed to deceive users into interacting with fraudulent interfaces, likely harvesting credentials or facilitating unauthorized transactions. Analysis indicates the domain was configured to mimic Aave’s legitimate platform, leveraging social engineering tactics to exploit trust in the brand. Infrastructure analysis reveals the domain pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net was registered through NameCheap, Inc. and utilized a Let’s Encrypt SSL certificate, a common tactic to appear legitimate. VirusTotal detection shows 3 out of 95 security vendors flagged the domain as malicious. The page title was recorded as 'Loading…', a generic placeholder that may precede a fully rendered phishing interface. Technologies detected include CDN77, which could obscure the true origin of the malicious content. The domain appears on two security blocklists and is blocked by MetaMask and SEAL, indicating prior identification as a threat. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it before deactivation. Mitigation steps for this threat type include immediate revocation of any credentials or wallet access that may have been exposed to the domain. Users should verify transaction histories for unauthorized activity and enable multi-factor authentication on all accounts associated with the targeted brand. Organizations should update blocklists to include this domain and monitor for similar impersonation attempts using Arweave-based infrastructure. Security teams are advised to analyze the domain’s historical DNS records and SSL certificate chain for additional indicators of compromise. Proactive monitoring of newly registered domains with similar naming patterns or hosting providers may prevent future attacks. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260607-8C3AAD ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net/ JSON API: https://api.destroy.tools/v1/check?domain=pdv76lvtrvebgfrw7t2plvrtdjuuzuvddrxn57pwhsf4nump3unq.arweave.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 171,556 domains (13,552 alive under monitoring, 157,543 confirmed takedowns/dead). Site: https://phishdestroy.io