aurexcapital[.]uk

This domain, aurexcapital.uk, is identified as a generic phishing infrastructure designed to impersonate a legitimate investment or financial services platform. Analysis indicates the site was constructed to deceive users into disclosing sensitive financial information, credentials, or transferring funds under false pretenses. The domain is currently offline, though prior activity suggests it was actively targeting individuals seeking investment opportunities. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered through NameCheap, Inc. on February 23, 2026, and resolves to the IP address 198.251.83.106. It appears on one security blocklist and is flagged by 9 of 95 security vendors on VirusTotal, including detection by PhishDestroy. The site employed a Let's Encrypt SSL certificate to simulate legitimacy, while underlying technologies included Firebase, LiteSpeed, TrackJs, Rudderstack, jsDelivr, jQuery, Google Tag Manager, and Google Analytics—tools commonly used for both tracking and obfuscation in phishing operations. The Gridinsoft trust score for this domain is 0 out of 100, and it has been documented in at least one threat intelligence pulse on AlienVault OTX. The domain has been taken offline, likely due to detection and enforcement actions. However, the infrastructure and registration patterns suggest potential for re-emergence under a similar or altered domain. Organizations and individuals are advised to block the domain aurexcapital.uk and its associated IP 198.251.83.106 at the network level. Security teams should monitor for domains registered through the same registrar with analogous naming conventions or resolving to the same IP range. Users who may have interacted with the site should be instructed to reset credentials on any financial or investment accounts, enable multi-factor authentication, and report any unauthorized transactions immediately. Proactive scanning for related indicators of compromise, including the technologies and tracking tools identified, is recommended to prevent further exposure.