# PhishDestroy domain threat record: aurix.click Content language: English Canonical HTML report: https://phishdestroy.io/domain/aurix.click/ Machine-readable companion: https://phishdestroy.io/domain/aurix.click/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 05:26:19 UTC - Last availability or vendor check: 2026-10-22 05:26:19 UTC - Stored record updated: 2026-10-22 06:30:29 UTC - VirusTotal detections in the stored snapshot: 18/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 185.62.57.222 - Registrar in stored WHOIS data: NETIM - Registrar country in stored WHOIS data: CA - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-05-31 09:39:39 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16211-384e-734d-99e7-f3fcf2cf412c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/aurix.click - Certificate Transparency search: https://crt.sh/?q=%25.aurix.click - Web Archive lookup: https://web.archive.org/web/*/https://aurix.click/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed aurix.click on its internal blocklist as a suspicious domain. The recorded page title advertises an AI trading platform. The domain was first seen by PhishDestroy on 2026-10-22, and an HTTP GET on that date returned a 200 status code. How the scam works A suspicious‑domain classification indicates the site could be used to lure visitors into providing credentials or personal data, but no specific malicious behavior was observed on the captured page. The AI‑trading claim is a common lure in fraudulent schemes, yet the listing is based on external detections rather than confirmed on‑site activity. Evidence VirusTotal scanned the domain on 2026-10-22; 15 vendors marked it malicious, 3 marked it suspicious, for a total of 18 detections out of 92 engines. Google Safe Browsing checked the same day and did not flag the URL. urlscan.io captured the page on 2026-10-22; its machine‑learning engine gave a malicious score of 97 while the overall verdict was non‑malicious. Cloudflare Radar scanned the site on 2026-10-22 and returned a malicious verdict with a malware category. OTX listed four pulses referencing the domain as of 2026-10-22. PhishDestroy’s internal blocklist contains the domain, whereas external blocklists returned zero hits on that date. Infrastructure The domain was registered with NETIM on 2026-05-31. DNS resolution returned the IP 185.62.57.222, recorded as belonging to Snel.com B.V. in the Netherlands. Nameservers are sage.ns.cloudflare.com and lina.ns.cloudflare.com, indicating Cloudflare DNS service. The TLS certificate, issued by ZeroSSL ECC DV SSL CA 2, is valid from 2026-08-31 to 2026-11-29 and covers only aurix.click. What to do If you visited the site and entered login or personal information, change those credentials immediately and monitor related accounts for unauthorized activity. Do not download files or grant any permissions from this site. Security teams should block aurix.click at firewalls or proxies, log any DNS or HTTP requests to 185.62.57.222, and keep the domain on threat‑intel feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16211-384e-734d-99e7-f3fcf2cf412c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/6d6c8f47-0d79-4e3c-9ec2-f9bb094969f7 URLQuery report: https://urlquery.net/report/99e3af31-7b2b-458c-84f9-beecbbcde1bd Stored capture screenshot: https://urlscan.io/screenshots/01a16211-384e-734d-99e7-f3fcf2cf412c.png Cloudflare Radar screenshot (2026-10-22T05:59:37Z): https://screenshots.phishdestroy.io/cf/6d6c8f47-0d79-4e3c-9ec2-f9bb094969f7.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/99e3af31-7b2b-458c-84f9-beecbbcde1bd.png VirusTotal report: https://www.virustotal.com/gui/domain/aurix.click Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aurix.click Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 06:01:39 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a16211-384e-734d-99e7-f3fcf2cf412c.png Captured: 2026-10-22 05:26:19 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16211-384e-734d-99e7-f3fcf2cf412c.png Captured: 2026-10-22 05:26:19 UTC Source report: https://urlscan.io/result/01a16211-384e-734d-99e7-f3fcf2cf412c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6d6c8f47-0d79-4e3c-9ec2-f9bb094969f7.png Captured: 2026-10-22 05:59:37 UTC Source report: https://radar.cloudflare.com/scan/6d6c8f47-0d79-4e3c-9ec2-f9bb094969f7 SHA-256: 5ac6244946bf3db82b62947300ef30d7143c771282a80f6567d700dc36808b2a - URLQuery: https://screenshots.phishdestroy.io/uq/99e3af31-7b2b-458c-84f9-beecbbcde1bd.png Source report: https://urlquery.net/report/99e3af31-7b2b-458c-84f9-beecbbcde1bd SHA-256: 04289bb3da3166ed95a85816410cce0ce6358f480d11977b8c3f3b5102759ea5 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1621a-49a7-76fc-88aa-66000dbcec0b.png Captured: 2026-10-22 05:34:23 UTC Source report: https://urlscan.io/result/01a1621a-49a7-76fc-88aa-66000dbcec0b/ SHA-256: 4130dbbd9117a10475a8d3b54f53929f614cdbad17cdf58c4288d5df4906f332 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T05:54:37Z", "uuid": "01a16211-384e-734d-99e7-f3fcf2cf412c", "scanned_at": "2026-10-22T05:24:28Z", "final_url": "https://aurix.click/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://aurix.click/", "from": "http://aurix.click/", "status": 307 } ], "ip": "185.62.57.222", "ptr": "s46024.hosted-by-snel.com", "domains": [ "cdn.jsdelivr.net", "challenges.cloudflare.com", "cdnjs.cloudflare.com", "fonts.gstatic.com", "www.cloudflare.com", "fonts.googleapis.com" ], "ips": [ "104.18.95.41", "104.17.208.5", "142.251.13.94", "104.18.94.41", "104.16.123.96", "2606:4700::6811:d005", "104.17.25.14", "2a00:1450:4001:c25::5f", "185.62.57.222" ], "asns": [ "13335", "15169", "62370" ], "countries": [ "US", "DE", "NL" ], "doc_hash": "36405b081fbb5ee7ba460d44091fc849a5c57b391c9f571a37db995b556dc9d3", "script_hashes": [ "06aae7eafe6ca5d233b17cad66cb03d1de0501cbb9310940ee0593d2c2da2b5a" ], "globals": [ "toggleTermsPopup", "intlTelInput", "__TS_SITEKEY", "__tsGet", "__tsReset", "__tsNeedsClick", "__tsShow", "__lgBS", "ClientJS", "__visitorCountry", "turnstile" ], "storage_keys": [ "t_cfp" ], "tls": { "san": [ "aurix.click" ], "cipher": "CHACHA20_POLY1305", "issuer": "ZeroSSL ECC DV SSL CA 2", "subject": "aurix.click", "protocol": "TLS 1.3", "valid_to": "2026-11-29T23:59:59Z", "valid_from": "2026-08-31T00:00:00Z" }, "domain_age_days": 1172, "apex_age_days": 1172, "tls_age_days": 52, "tls_valid_days": 90, "requests": 22, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T06:00:46Z", "uuid": "6d6c8f47-0d79-4e3c-9ec2-f9bb094969f7", "scanned_at": "2026-10-22T05:59:37Z", "final_url": "https://aurix.click/", "status": 200, "history": [ { "url": "https://aurix.click/", "status": 200 } ], "dom_hash": "b03210b6eebacaa38e24cc9766b22b7f748620daf1a64823ee6d3079d85367ed", "doc_hash": "36405b081fbb5ee7ba460d44091fc849a5c57b391c9f571a37db995b556dc9d3", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "aurix.click", "type": "A", "value": "185.62.57.222" } ], "dnssec_valid": false, "ip": "185.62.57.222", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NETIM SARL", "created": "2026-05-31T11:39:38Z", "updated": "2026-06-05T11:40:11Z", "expires": "2027-05-31T11:39:38Z", "nameservers": [ "sage.ns.cloudflare.com", "lina.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T05:59:24Z", "analysis_at": "2026-10-22T00:07:08Z", "stats": { "timeout": 0, "harmless": 42, "malicious": 15, "suspicious": 3, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Criminal IP": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "NETIM", "created": "2026-05-31T11:39:38Z", "expires": "2027-05-31T11:39:38Z", "updated": "2026-06-05T11:40:11Z", "first_seen": "2023-12-01T17:53:28Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "sage.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "185.62.57.222" }, { "ttl": 21600, "type": "NS", "value": "lina.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "lina.ns.cloudflare.com" } ], "dns_at": "2026-10-22T00:07:28Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "aurix.click" ], "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "serial": "16634d1b7c72cd5c8ba17088906f723f", "sha256": "1b87ee353a3e868f286092e4c254c8c6ef8a0d2c46eb8019ef32bea7dd0e133d", "subject": "aurix.click", "valid_to": "2026-11-29T23:59:59Z", "valid_from": "2026-08-31T00:00:00Z" }, "whois": { "registrar": "NETIM", "registrar_iana_id": "1519", "registrar_url": "https://www.netim.com", "created": "2026-05-31T00:00:00Z", "updated": "2026-05-31T13:39:37Z", "expires": "2027-05-31T21:00:00Z", "status": [ "clientTransferProhibited", "ok" ], "nameservers": [ "lina.ns.cloudflare.com", "sage.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "active", "client transfer prohibited" ], "events": { "expiration": "2027-05-31T21:00:00Z", "last changed": "2026-05-31T13:39:37Z", "registration": "2026-05-31T00:00:00Z", "registrar expiration": "2027-05-31T21:00:00Z", "last update of RDAP database": "2026-10-17T13:54:05Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T06:01:04Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "aurix.click" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-22T05:28:54Z", "first": "2024-05-22T21:44:17Z", "changes": 2, "days_archived": 3, "scans_per_day": 0, "avg_page_bytes": 5264 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://aurix.click/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 140 }, "social_tags": { "ogUrl": "https://aurix.click/", "title": "aurix | a premium AI trading platform | Official Website", "ogType": "website", "robots": "index, follow", "ogTitle": "aurix | AI-Powered Automated Trading Assistance", "ogSiteName": "aurix", "themeColor": "#101010", "description": "aurix provides AI-powered trading assistance with automated trading bots, structured risk controls, and operational transparency for informed...", "twitterCard": "summary", "canonicalUrl": "https://aurix.click/", "ogDescription": "aurix provides AI-powered trading assistance with automated trading bots, structured risk controls, and operational transparency for informed execution workflows." }, "trackers": { "requests": 19, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 6 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 4 } ] }, "mixed_content": { "no_sri": [ "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 208, "tls": 35, "wait": 24, "connect": 33, "download": 56 }, "response_ms": 356 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_CHACHA20_POLY1305_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "ocsp_stapled": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 48655, "co2_grams": 0.0018, "cleaner_than": 38 }, "dns_server": { "ns": [ { "ip": "172.64.35.236", "host": "sage.ns.cloudflare.com" }, { "ip": "173.245.58.187", "host": "lina.ns.cloudflare.com" } ], "zone": "aurix.click" }, "location": { "ip": "185.62.57.222", "asn": "62370", "org": "Snel.com B.V.", "country": "NL" }, "ssl": { "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "subject": "aurix.click" }, "dns": { "A": [ "185.62.57.222" ], "NS": [ "lina.ns.cloudflare.com", "sage.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"lina.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418048067, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "no-referrer-when-downgrade", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "185.62.57.222", "family": 4 }, "redirects": { "chain": [ "https://aurix.click" ] }, "tech_stack": { "technologies": [ "Cloudflare", "Cloudflare Turnstile", "ClientJS", "Priority Hints", "jsDelivr", "Google Font API", "Font Awesome", "cdnjs", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 38 }, "whois": { "registrar": "NETIM SARL", "created": "2026-05-31T11:39:38Z", "updated": "2026-06-05T11:40:11Z", "expires": "2027-05-31T11:39:38Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "sage.ns.cloudflare.com", "lina.ns.cloudflare.com" ] }, "headers": { "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } } } } ```