aurextrades[.]com

On 23 July 2026, the domain aurextrades.com was identified as a generic phishing site targeting cryptocurrency users. The site presented the page title “Aurex Trades – The Most Trusted Crypto Company,” suggesting an attempt to convey legitimacy. Registration data shows the domain was created on 21 February 2026 through Cosmotown, Inc., and is currently resolved to the IP address 161.97.121.66, which belongs to AS51167 (Contabo GmbH) in France. The hosting provider is fronted by Cloudflare, as indicated by the authoritative nameservers arel y.ns.cloudflare.com and toby.ns.cloudflare.com, and the site supported HTTP/3. An SSL certificate issued by Google Trust Services under the WE1 root was observed, confirming the presence of TLS encryption.

Technical fingerprinting revealed the use of common web libraries including Bootstrap, OWL Carousel, jQuery, FancyBox, and the live‑chat widget JivoChat. These components are often found in legitimate sites and do not, by themselves, indicate malicious intent, but they confirm that the page was built with publicly available frameworks. VirusTotal analysis recorded 13 detections out of 93 scanned security vendors, reinforcing the suspicion of malicious activity. The domain also appears on a single security blocklist and was blocked by the PhishDestroy service, after which the site was taken offline. Gridinsoft assigned a trust score of 1 out of 100, the lowest possible rating.

While the offline status precludes real‑time interaction, the available evidence is sufficient to label the infrastructure as confirmed phishing. Uncertainties remain regarding the exact phishing kit or the specific victim collection mechanism, as no screenshots or form captures have been disclosed. Defenders should continue to block aurextrades.com at network borders, update endpoint protection rules with the observed hash signatures, and monitor for any re‑hosting attempts that reuse the same IP range or SSL certificate fingerprint.