aurvenixt-de[.]live

This domain, aurvenixt-de.live, is identified as a generic phishing site targeting users through a fraudulent AI-assisted trading platform. The page title, 'Aurvenixt | Offizielle Plattform für KI-gestütztes Trading,' suggests an attempt to impersonate a legitimate trading service by leveraging artificial intelligence as a lure. No specific brand impersonation or crypto drainer kit signatures were confirmed, but the domain’s infrastructure and content align with typical phishing campaigns aimed at credential harvesting or financial fraud. Analysis indicates the site likely targeted German-speaking users, given the language used in the title and interface elements. Infrastructure analysis reveals the domain was registered on May 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.48.85, a Cloudflare-protected endpoint, which is common for phishing sites seeking to obscure their origin. The domain appears on one security blocklist and is flagged by 5 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let’s Encrypt, a legitimate but often abused certificate authority in phishing operations. Technologies detected include Unpkg, jsDelivr, jQuery, IPinfo, and Cloudflare Browser Insights, which are consistent with modern web-based phishing frameworks. As of the latest assessment, aurvenixt-de.live has been taken offline, reducing immediate exposure risk. However, the domain’s registration remains active, and similar infrastructure could be repurposed for future campaigns. Users who interacted with the site should assume potential credential compromise and monitor financial accounts for unauthorized activity. Organizations are advised to block the domain and associated IP address in network security controls. Continued vigilance is recommended, as threat actors often reuse registrars and hosting providers for subsequent phishing operations.