# PhishDestroy threat dossier — aura-claim.xyz ================================================================ Fetched: 2026-08-01 09:29:45 UTC Canonical: https://phishdestroy.io/domain/aura-claim.xyz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 90/100 (PhishDestroy scoring — see methodology below) Scam classification: Crypto Drainer Targeted brand: MetaMask ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Chong Lua Dao, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.67.158.86 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: ligia.ns.cloudflare.com, steven.ns.cloudflare.com Registered: 2026-07-28 Expires: 2027-07-28 Page title: Web Development Studio ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-26 Status: INVALID chain Fingerprint: d19954a9e5b35d899a2fa0208317051778f39c78c047d4a021b22ca571da6f6f ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-28 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-30 14:07:11 UTC (by PhishDestroy tracker) First reported: 2026-07-30 12:08:32 UTC (abuse notice filed) Last verified: 2026-08-01 10:14:36 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fb304-3654-750e-bd7a-d904972c2d87/ URLQuery: https://urlquery.net/report/e5e14b8a-2192-4664-b24b-b52050bd0c9e Wayback Machine: https://web.archive.org/web/*/aura-claim.xyz crt.sh CT logs: https://crt.sh/?q=%25.aura-claim.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=aura-claim.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/aura-claim.xyz URLhaus: https://urlhaus.abuse.ch/host/aura-claim.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-30 14:08:57 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] aura-claim.xyz Crypto Drainer Alert Analysis indicates that aura-claim.xyz was registered through PublicDomainRegistry.com on 28 July 2026 and resolves to the Cloudflare‑hosted address 172.67.158.86, served by the authoritative nameservers ligia.ns.cloudflare.com and steven.ns.cloudflare.com. The domain is classified as a crypto‑drainer campaign and has been added to multiple defensive feeds, including PhishDestroy, MetaMask, SEAL, and three additional public blocklists. VirusTotal records show three of ninety‑one scanners flagging the domain, reinforcing the suspicion of malicious intent. No public SSL certificate details, HTTP status codes, or page‑title metadata have been released, and the site content has not been crawled, leaving the exact lure technique undefined. The rapid creation date, use of Cloudflare’s Anycast infrastructure, and immediate inclusion on blocklists suggest a purpose‑built operation targeting cryptocurrency users, likely attempting to intercept wallet credentials or redirect transactions. The hosting IP belongs to Cloudflare’s global network, a frequent choice for threat actors because it obscures the true origin of the service. Defenders should proactively deny DNS resolution for aura-claim.xyz, add the address to firewall and proxy deny lists, and monitor outbound connections to the associated IP. SOC teams should generate alerts on any authentication attempts to wallet services that involve this domain and enforce multi‑factor authentication and hardware‑wallet isolation for crypto assets. Continuous threat‑intel feed monitoring is advised to capture any updates on payload delivery, command‑and‑control infrastructure, or related domains. Given the active status, any traffic to aura-claim.xyz should be treated as hostile. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260730-337BFC TLS cert SHA-256: d19954a9e5b35d899a2fa0208317051778f39c78c047d4a021b22ca571da6f6f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/aura-claim.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=aura-claim.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,261 domains (91,188 alive under monitoring, 27,323 confirmed neutralized). Site: https://phishdestroy.io