auroragold[.]org

The domain auroragold.org is a confirmed phishing site engaged in brand impersonation targeting Google. It was designed to deceive users into believing they were interacting with a legitimate Google service, posing an elevated risk of credential theft or fraudulent activity. As of the latest verification, auroragold.org has been taken offline, though it previously operated as an active scam site.

Technical analysis reveals auroragold.org was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appeared on 1 security blocklist (PhishDestroy). The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on June 20, 2025, and resolved to the IP address 192.3.190.186, hosted on AS36352 (HostPapa) in the US. No SSL certificate was present, and the observed page title was 'Aurora Gold - Home'. Nameservers were dns1.webproserver.com and dns2.webproserver.com. AlienVault OTX recorded the domain in 1 threat intelligence pulse, while Gridinsoft and Scamadviser assigned trust scores of 0/100 and 1/100, respectively.

Users who may have interacted with auroragold.org should immediately change any passwords entered on the site, particularly for Google accounts, and enable two-factor authentication (2FA) if not already active. Monitor financial and account activity for signs of unauthorized access or fraud. Report the domain to Google’s anti-phishing team via their reporting page and submit it to additional threat intelligence platforms such as PhishTank or OpenPhish to aid in broader detection efforts.