auntrixcipherai-es[.]net

This domain, auntrixcipherai-es.net, is classified as a high-risk brand impersonation threat targeting Base, a cryptocurrency platform. Analysis indicates the domain is designed to deceive users into believing it is an official trading or AI-powered investment service, as evidenced by its page title, 'Auntrix Cipher AI - Plataforma Oficial | Trading IA 2026.' The intent appears to be credential harvesting, fraudulent fund transfers, or the distribution of malicious payloads under the guise of legitimate financial services. Infrastructure analysis reveals the domain resolves to IP address 172.67.133.107, hosted on Cloudflare's network (AS13335). It was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. Google Safe Browsing categorizes it as a phishing site. Notably, the domain lacks an SSL certificate, increasing the risk of man-in-the-middle attacks or data interception during user interactions. Mitigation of this threat requires immediate action from network defenders and end-users. Organizations should block the domain and its associated IP (172.67.133.107) at the firewall or DNS level to prevent access. End-users should be educated on recognizing brand impersonation tactics, particularly those involving cryptocurrency platforms, and encouraged to verify domain authenticity through official channels. Security teams should monitor for related domains registered through the same registrar (PDR Ltd.) or resolving to the same IP range, as these may indicate additional malicious infrastructure. Given the domain's current offline status, continuous monitoring is advised to detect any reactivation attempts.