aurorawallet[.]app

The domain aurorawallet.app was observed on July 12, 2026 and is classified as a high‑risk crypto drainer. Automated analysis and threat intelligence attribute the site to active phishing operations that aim to harvest cryptocurrency credentials. The site returns HTTP 200 and presents a page titled “Aurora AI Wallet – Your Wallet. Your AI. Your Rewards.” indicating a masquerade as a legitimate AI‑enhanced crypto wallet. Infrastructure analysis shows the domain was registered on 26 November 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. Authoritative DNS is provided by ns1.hostns.io and ns2.hostns.io. The domain resolves to IP address 91.204.209.45, which is announced by AS52148 belonging to Enix Ltd in Great Britain. The service uses a Let’s Encrypt TLS certificate signed under the YR2 identifier, confirming the presence of standard HTTPS encryption but offering no indication of legitimate ownership. Reputation services flag the domain heavily. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of credibility. VirusTotal reports that 2 of 95 security vendors have flagged the domain, and the domain appears on a single public blocklist, currently enforced by PhishDestroy. The combination of a low trust score, limited vendor detection, and blocklist inclusion aligns with the observed generic phishing behavior. Defenders should block aurorawallet.app at network perimeter and update endpoint detection signatures to include the associated IP 91.204.209.45 and the hostns.io nameservers. Monitoring of TLS certificates issued by Let’s Encrypt for this domain may provide early warning of future re‑registrations. Users should be warned that any credential entry on the site is likely to be harvested for unauthorized cryptocurrency transactions, and remediation should include credential rotation and wallet security audits.