aurex-ex[.]com

This domain, aurex-ex.com, is flagged as a high-risk phishing site specializing in crypto asset drainage. Analysis indicates it impersonates AurexPro Exchange, a legitimate cryptocurrency trading platform, using a near-identical page title and branding elements to deceive users. The site likely employs a cryptocurrency drainer kit designed to automatically siphon funds from connected wallets upon interaction, a common tactic in targeted phishing campaigns against crypto users. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through GMO Internet, Inc., an unusual future date suggesting potential domain spoofing or registry manipulation. It resolves to IP address 16.54.65.91, hosted on Amazon.com, Inc. (AS16509) infrastructure in Canada. The SSL certificate is issued by 广东堡塔安全技术有限公司 (Baota DV TLS RSA CA 2025), a provider often associated with low-cost or automated certificate issuance. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. Google Safe Browsing status remains unconfirmed at this time, though the domain is actively blocked by PhishDestroy, MetaMask, and SEAL. As of the latest verification, aurex-ex.com remains active and unresolved by the registrar. Users are advised to treat any interaction with this domain as a direct threat to digital asset security. Immediate response actions include blocking the domain at the network level, revoking any wallet permissions granted to associated addresses, and monitoring for unauthorized transactions. The remaining risk is classified as high due to the domain's persistence, targeted nature, and potential for financial loss. Crypto wallet users should verify domain authenticity through official channels before connecting wallets or entering credentials.