# PhishDestroy domain threat record: auraboxs.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/auraboxs.com/
Machine-readable companion: https://phishdestroy.io/domain/auraboxs.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 04:30:17 UTC
- Last availability or vendor check: 2026-10-27 12:30:44 UTC
- Stored record updated: 2026-10-27 23:21:13 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: revolut

## Stored infrastructure

- Observed IP address: 172.67.190.86
- Registrar in stored WHOIS data: NAMECHEAP INC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-20 01:16:08 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17b9e-b958-72f9-9557-8af25ffe8218/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/auraboxs.com
- Certificate Transparency search: https://crt.sh/?q=%25.auraboxs.com
- Web Archive lookup: https://web.archive.org/web/*/https://auraboxs.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classifies auraboxs.com as a fake token airdrop page. The recorded page title reads Ginnancoin | Airdrop. An intake note indicated a Cloudflare security challenge prevented direct content inspection, and the domain was added to the blocklist after an admin report on 2026-10-27.

How the scam works
Fake airdrop pages typically lure visitors to connect a cryptocurrency wallet by promising free tokens, then harvest private keys, seed phrases, or obtain token‑approval permissions that enable unauthorized transfers. The promise of a Ginnancoin claim is a social‑engineering bait designed to extract wallet access without any legitimate token distribution.

Evidence
VirusTotal scanned the domain on 2026-10-27 with 92 engines and reported zero detections. Google Safe Browsing showed no flag on the same date. OTX listed four pulses referencing the domain as of 2026-10-27. External blocklists MetaMask and SEAL each listed the domain, and PhishDestroy’s internal list marked it as malicious. URLScan captured a redirect chain to ginnan.solfast.cc, where its engine scored the page 81 with a malicious tag, though the overall verdict was non‑malicious; Cloudflare Radar identified the final URL as phishing.

Infrastructure
The domain was registered on 2026-10-20 through NameCheap Inc. The recorded IP was 172.67.190.86, served via Cloudflare and recorded in Canada. The certificate check found a Let's Encrypt TLS certificate valid until 2027-01-18. Nameservers were chelsea.ns.cloudflare.com and glen.ns.cloudflare.com.

What to do
Do not enter wallet credentials or approve any token requests on this site; if you have already connected a wallet, revoke all approvals and consider moving assets to a new wallet. Users should report the address to their wallet providers and monitor for unauthorized activity. Defenders should block auraboxs.com and its redirect target ginnan.solfast.cc at the network perimeter and review logs for any connections to these hosts.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17b9e-b958-72f9-9557-8af25ffe8218/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8032026f-d720-4610-9fdc-763bd93bb2af
Stored capture screenshot: https://i.ibb.co/7N4Cvq4k/31973a62a4e3.png
Cloudflare Radar screenshot (2026-10-27T05:02:24Z): https://screenshots.phishdestroy.io/cf/8032026f-d720-4610-9fdc-763bd93bb2af.png
URLScan screenshot (2026-10-27T04:24:10Z): https://screenshots.phishdestroy.io/us/01a17b99-af18-72cb-bc3f-422a6506fce8.png
URLScan capture report: https://urlscan.io/result/01a17b99-af18-72cb-bc3f-422a6506fce8/
URLScan screenshot (2026-10-27T04:40:08Z): https://screenshots.phishdestroy.io/us/01a17ba8-7b2e-7568-a9fd-6286f3199566.png
URLScan capture report: https://urlscan.io/result/01a17ba8-7b2e-7568-a9fd-6286f3199566/
VirusTotal report: https://www.virustotal.com/gui/domain/auraboxs.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=auraboxs.com
Archived copy: https://web.archive.org/web/20261027043131/https://auraboxs.com/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 06:13:43 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/7N4Cvq4k/31973a62a4e3.png
  Captured: 2026-10-27 04:30:17 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17b9e-b958-72f9-9557-8af25ffe8218.png
  Captured: 2026-10-27 04:30:17 UTC
  Source report: https://urlscan.io/result/01a17b9e-b958-72f9-9557-8af25ffe8218/
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17b99-af18-72cb-bc3f-422a6506fce8.png
  Captured: 2026-10-27 04:24:10 UTC
  Source report: https://urlscan.io/result/01a17b99-af18-72cb-bc3f-422a6506fce8/
  SHA-256: 018dce39ca742f6d70e4bd0613a352e007e5cc0742c368d30c97e037ef5c7c94
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17ba8-7b2e-7568-a9fd-6286f3199566.png
  Captured: 2026-10-27 04:40:08 UTC
  Source report: https://urlscan.io/result/01a17ba8-7b2e-7568-a9fd-6286f3199566/
  SHA-256: fd5f13e148b0c0b812dd8dee703925a65270b6217173eab4fe7f1532eb56be3a
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8032026f-d720-4610-9fdc-763bd93bb2af.png
  Captured: 2026-10-27 05:02:24 UTC
  Source report: https://radar.cloudflare.com/scan/8032026f-d720-4610-9fdc-763bd93bb2af
  SHA-256: 36d214d2a3ffc28304bc8979662c6e4644a589cd23bf388b15228ec9be9d0644

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T05:04:15Z",
        "uuid": "01a17b9e-b958-72f9-9557-8af25ffe8218",
        "scanned_at": "2026-10-27T04:29:31Z",
        "final_url": "https://ginnan.solfast.cc/",
        "status": 200,
        "redirected": "off-domain",
        "redirects": [
            {
                "to": "https://auraboxs.com/",
                "from": "http://auraboxs.com/",
                "status": 307
            },
            {
                "to": "https://ginnan.solfast.cc/",
                "from": "https://auraboxs.com/",
                "status": 302
            }
        ],
        "ip": "172.67.189.1",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com",
            "lite-api.jup.ag",
            "auraboxs.com"
        ],
        "ips": [
            "18.66.122.122",
            "142.250.154.94",
            "2a00:1450:4001:c13::5f",
            "172.67.189.1",
            "172.67.190.86"
        ],
        "asns": [
            "16509",
            "15169",
            "13335"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "x.com",
            "t.me",
            "discord.gg"
        ],
        "social": [
            "https://x.com/ginnan_token",
            "https://t.me/ginnan_token",
            "https://discord.gg/ginnan_token"
        ],
        "doc_hash": "475ac89e8baf54716a1ff97ab478fa246d9bed8e8d01cc938554d1216c8dd41f",
        "script_hashes": [
            "1c86e1bc414a887f24f26844dfe9bf3cd453703a4220ae1c70499009adf4c18e",
            "22e6ca9afed46ee3a6de1970e1aa50b00b560663c8735e7c88a636a84ffb9713"
        ],
        "globals": [
            "INITIAL_MC",
            "INITIAL_VOLUME",
            "INITIAL_CHANGE",
            "INITIAL_PRICE",
            "TOKEN_SYMBOL",
            "TOKEN_ADDRESS",
            "bindEvents",
            "initFAQ",
            "initializeTransactions",
            "startTransactionRotation",
            "addNewTransaction",
            "generateFakeTransaction",
            "generateRandomHash",
            "generateRandomAddress",
            "createTransactionElement",
            "fmtNumber",
            "formatNumberShort",
            "updateTokenData",
            "fetchTokenData",
            "_0uwv",
            "litPropertyMetadata",
            "reactiveElementVersions",
            "litHtmlVersions",
            "litElementVersions",
            "transactionTimer",
            "tokenData",
            "fmt"
        ],
        "storage_keys": [
            "token-price-cache-GINNAN",
            "_0x12",
            "_0x5"
        ],
        "tls": {
            "san": [
                "*.solfast.cc",
                "solfast.cc"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "solfast.cc",
            "protocol": "QUIC",
            "valid_to": "2027-01-18T12:44:06Z",
            "valid_from": "2026-10-20T12:44:07Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 3,
        "tls_age_days": 6,
        "tls_valid_days": 89,
        "requests": 22,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 81,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T05:04:17Z",
        "uuid": "8032026f-d720-4610-9fdc-763bd93bb2af",
        "scanned_at": "2026-10-27T05:02:24Z",
        "final_url": "https://ginnan.solfast.cc/",
        "status": 200,
        "redirected": "off-domain",
        "history": [
            {
                "url": "https://auraboxs.com/",
                "status": 302
            },
            {
                "url": "https://ginnan.solfast.cc/",
                "status": 200
            }
        ],
        "dom_hash": "b32b233f9880b0bfb3f42bb78a21b9c21041ca0ce63a0a9fa467f737b7dfee6b",
        "doc_hash": "d629f9709437e31300ab58ce4efd2783dad1ead0b7a857ae3891f5e64c5ae570",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ginnan.solfast.cc",
                "type": "A",
                "value": "104.21.51.223"
            },
            {
                "name": "ginnan.solfast.cc",
                "type": "A",
                "value": "172.67.189.1"
            },
            {
                "name": "ginnan.solfast.cc",
                "type": "AAAA",
                "value": "2606:4700:3034::6815:33df"
            },
            {
                "name": "ginnan.solfast.cc",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:bd01"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.51.223",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-20T13:40:47Z",
            "updated": "2026-10-20T13:40:47Z",
            "expires": "2027-10-20T13:40:47Z",
            "nameservers": [
                "dimitris.ns.cloudflare.com",
                "khloe.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T06:08:05Z",
        "analysis_at": "2026-10-27T05:18:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "registrar": "NAMECHEAP INC",
        "created": "2026-10-20T03:16:08Z",
        "expires": "2027-10-20T03:16:08Z",
        "updated": "2026-10-20T03:16:17Z",
        "first_seen": "2025-08-06T16:03:10Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.190.86"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "glen.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:4c3e"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "chelsea.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:be56"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.76.62"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "chelsea.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-27T05:23:32Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.auraboxs.com",
                "auraboxs.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5c0e5e2c2aaca5ff06dc8b5942abcc649ae",
            "sha256": "72699017fc5cd26ebaefe5c25140c0a3f9a10d6b69306a59244c7b6b9f54d247",
            "subject": "auraboxs.com",
            "valid_to": "2027-01-18T02:21:00Z",
            "valid_from": "2026-10-20T02:21:01Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2026-10-20T03:16:08Z",
            "updated": "1-01-01T00:00:00Z",
            "expires": "2027-10-20T03:16:08Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "chelsea.ns.cloudflare.com",
                "glen.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "registration": "2026-10-20T03:16:08Z",
                "registrar expiration": "2027-10-20T03:16:08Z",
                "last update of RDAP database": "2026-10-20T11:03:21Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T05:04:34Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "auraboxs.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-27T04:31:31Z",
            "first": "2026-10-27T04:31:31Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 741989
        },
        "trackers": {
            "requests": 2
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 62,
                "tls": 97,
                "wait": 397,
                "connect": 28,
                "download": 2315
            },
            "response_ms": 2899
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 3162746,
            "co2_grams": 0.1157,
            "cleaner_than": 1
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.177",
                    "host": "chelsea.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.169",
                    "host": "glen.ns.cloudflare.com"
                }
            ],
            "zone": "auraboxs.com"
        },
        "location": {
            "ip": "2606:4700:3032::ac43:be56",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "auraboxs.com"
        },
        "dns": {
            "A": [
                "104.21.76.62",
                "172.67.190.86"
            ],
            "NS": [
                "chelsea.ns.cloudflare.com",
                "glen.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"chelsea.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417978560, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3032::ac43:be56",
                "2606:4700:3034::6815:4c3e"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "DENY",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; base-uri 'self'; for",
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3034::6815:4c3e",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://auraboxs.com"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.cloudflare.com/",
                "https://www.cloudflare.com/privacypolicy/"
            ],
            "external_count": 2
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-10-20T03:16:08Z",
            "updated": "2026-10-20T03:16:17Z",
            "expires": "2027-10-20T03:16:08Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "chelsea.ns.cloudflare.com",
                "glen.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "content-security-policy": "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; script-src 'nonce-e1b3413731a670f9d66627bf6a9bf405' 'unsafe-eval'",
                "x-frame-options": "DENY",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin"
            }
        }
    }
}
```