audicontadores[.]com

Analysis of the domain audicontadores.com indicates it is actively hosting a fraudulent Bitcoin airdrop scheme, as evidenced by its page title 'BTC Airdrop — $100 Reward for Active Traders.' The domain, registered through NAMECHEAP INC on June 17, 2011, resolves to the IP address 162.245.189.194, associated with a US-based hosting provider. Infrastructure analysis reveals the use of nameservers ns17.tepuyserver.net and ns18.tepuyserver.net, which have been linked to multiple phishing campaigns in threat intelligence repositories. The domain appears in 50 AlienVault OTX pulses, suggesting widespread recognition as malicious infrastructure. The site employs a Let's Encrypt SSL certificate (R13) and returns an HTTP 200 status, confirming its operational status as of July 12, 2026. Technologies detected include WordPress, MySQL, PHP, and LiteSpeed, alongside frontend libraries such as jQuery and Lightbox. While the exact phishing kit is classified as an 'Airdrop Scam,' no further details about its functionality or backend mechanisms are currently available. The domain is blocked by at least four security blocklists, including PhishDestroy and URLhaus, and is flagged by 17 of 91 security vendors in aggregated scans. Defenders should treat this domain as high-risk due to its persistent activity, established malicious infrastructure, and confirmed association with cryptocurrency fraud. No legitimate use case has been identified, and the domain's long-standing registration date does not mitigate its current threat status. Network-level blocking and monitoring for connections to 162.245.189.194 or the tepuyserver.net nameservers are recommended to mitigate exposure.