aureviacapital.org is a domain on the PhishDestroy blocklist whose name is styled like an investment or capital-management firm. PhishDestroy first saw it on 2026-09-17, less than four weeks after it was registered. The site went offline on 2026-09-24, and its DNS was still inactive when we last checked on 2026-10-19.
How the scam works
PhishDestroy has not assigned a specific scheme to this domain. The signals around it still point to risk. A freshly registered, finance-branded name flagged by several security engines and listed by Spamhaus fits sites that ask visitors to hand over money, account logins or wallet access. Anyone who dealt with it should assume that anything sent or entered there was exposed.
Evidence
VirusTotal shows 5 of 91 engines flagging the domain as of 2026-09-25: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Netcraft and SOCRadar. The count is modest, but these vendors work independently, and Netcraft focuses specifically on phishing and fraud. Spamhaus lists the domain in its DBL as a spam domain, which links it to unsolicited mail or messaging campaigns. Three AlienVault OTX pulses also reference it, so other researchers have tracked it as part of threat activity.
Infrastructure
The domain was registered through Spaceship, Inc. on 2026-08-21 and flagged by PhishDestroy 27 days later. It stopped resolving one week after that. A lifespan of roughly a month from registration to going dark is typical of throwaway domains that are used briefly and then abandoned. The same operators may already be running similar names elsewhere.
What to do
If you sent money or crypto through aureviacapital.org, stop all further payments. Ignore any request for "release", "tax" or "withdrawal" fees, and keep your transaction records for a report to your bank, exchange or local police. If you entered a password, change it everywhere you reused it and turn on two-factor authentication. If you connected a crypto wallet, revoke the approvals it granted and move your remaining funds to a fresh wallet. Treat any email or message that pointed you to this domain as hostile, and be wary of similar "capital" brands contacting you afterwards. Defenders should block the domain in DNS and mail filters and search mail logs for messages containing it.
Primary outcomeDNS 非アクティブreason: DNS NXDOMAIN80% confidence
Attributionsource: Dns Cache
Evidence layersAvailability: DNS inactiveContent: UnreachableDNS: NXDOMAINRegistration: Unknown
Latest HTTP observation不明Probe Inconclusive20%2026-10-19 01:16:35 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-09-17 17:28:07 UTCcurrent episode first observed: 2026-09-30 16:14:55 UTCobserved RIP window: 2026-09-17 17:28:07 UTC → 2026-09-30 16:14:55 UTC · 310.78hmidpoint estimate ≈ 2026-09-24 04:51:31 UTC · precision low · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
