support-trezuresuties-home[.]aura[.]build

This domain is flagged as an elevated-risk credential-theft phishing site targeting users through fraudulent support page impersonation. Analysis indicates the infrastructure was specifically designed to mimic legitimate service portals, with the intent to harvest login credentials, personal information, or financial details from unsuspecting victims. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain support-trezuresuties-home.aura.build was registered on February 21, 2026, through Name.com, Inc., and resolves to IP address 63.176.8.218, hosted on Amazon Web Services infrastructure (AS16509). The SSL certificate is issued by Let's Encrypt (serial E7), a common tactic to lend superficial legitimacy. Security vendors have flagged this domain at a rate of 17/95 on VirusTotal, while it appears on at least one security blocklist. The page title, support-trezuresuties-home | Aura, directly mimics official branding to increase plausibility. Mitigation requires immediate action from both end users and security teams. Users who accessed this domain should invalidate any credentials entered, enable multi-factor authentication on all accounts, and monitor for unauthorized activity. Security teams should block the domain and IP at perimeter controls, add the SSL certificate fingerprint to detection rules, and alert users to phishing campaigns impersonating support portals. Domain registrars and hosting providers should be notified to facilitate takedown procedures. Proactive monitoring for similar domains using the aura.build namespace is recommended to prevent follow-on attacks.