aureusx[.]org

On 24 July 2026, the domain aureusx.org was observed to host a generic phishing page titled “CFD & Forex Trading | Stocks & CFDs on Commodities | Aureusx”. The site was taken offline at the time of analysis but historical data indicate it was registered on 21 February 2026 through Name.com, Inc. The authoritative name servers ns27.my‑control‑panel.com and ns28.my‑control‑panel.com resolve the domain to the IPv4 address 198.251.89.220, which is allocated to AS53667 FranTech Solutions in the United States. The hosting infrastructure reports LiteSpeed web server behind a Cloudflare reverse‑proxy and presents a Let’s Encrypt R12 certificate for HTTPS. A review of the page’s technology stack shows Bootstrap, jQuery, jsDelivr, Polyfill, Taboola and HubSpot Analytics, suggesting a marketing‑oriented site design. Threat intelligence sources have flagged aureusx.org on a single blocklist and it is listed by PhishDestroy as a malicious domain.

The domain appears in one AlienVault OTX pulse, indicating limited but existing community reporting. VirusTotal scans show eight of ninety‑three antivirus engines labeling the domain as malicious, reinforcing the suspicion of phishing activity. The domain’s MX record is configured with a priority of zero pointing to aureusx.org itself, a pattern often seen in malicious domains that attempt to receive email. While the page content has not been captured, the combination of a financial‑focused title, the presence of advertising and analytics services, and the detection history point to a credential‑harvesting or fraudulent investment lure. Uncertainty remains regarding the exact phishing workflow, such as whether credential capture forms were present or if the site redirected victims to further malicious resources.

Defenders should block the domain at network perimeter and DNS layers, monitor for any outbound connections to the IP 198.251.89.220, and add the domain to internal blocklists.