aureliscapital[.]com

Analysis of the domain aureliscapital.com confirms its classification as a phishing site targeting New Republic Bank customers. The domain was registered on September 30, 2025, through Dynadot LLC and currently resolves to the IP address 198.23.193.170, hosted on AS36352 (HostPapa) in the United States. No SSL certificate is present, which is atypical for legitimate financial institutions and increases the risk of credential interception. The domain's nameservers, dns1.geebytesdns.com and dns2.geebytesdns.com, are consistent with infrastructure observed in prior phishing campaigns, though they are not inherently malicious on their own.

The page title, 'New Republic Bank - Banking Solutions Built for You,' directly aligns with the branding of the targeted financial institution, indicating an intent to deceive users into believing the site is legitimate. Detection data supports this assessment, with the domain appearing on at least one security blocklist and flagged by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious nature. VirusTotal reports that 4 of 95 security vendors have detected the domain as malicious, a modest but notable confirmation given the variability in vendor detection rates.

Infrastructure analysis reveals no additional subdomains or linked infrastructure at this time, though the use of HostPapa's hosting services is consistent with patterns observed in low-cost, disposable phishing operations. The domain's current offline status suggests either takedown action or voluntary suspension by the threat actor, though defenders should treat it as a historical indicator of compromise. Organizations are advised to block the domain and IP at the perimeter, monitor for credential reuse from affected users, and review logs for connections to 198.23.193.170 or related nameserver activity.