auracards[.]org

This domain is currently under investigation for operating as a fake crypto card phishing site, targeting users with promises of cryptocurrency services without KYC verification. Analysis indicates the site impersonates legitimate crypto payment platforms to harvest credentials or distribute malicious payloads, though no specific drainer functionality has been confirmed yet. The domain presents itself as "Aura Pay | Crypto Card without KYC," a lure designed to exploit users seeking anonymity in financial transactions. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.145.198, hosted behind Cloudflare, which provides additional obfuscation through its CDN and HTTP/3 support. The site is currently offline, but prior scans show it was detected on two security blocklists (ScamSniffer and PhishDestroy) and had no detections on VirusTotal (0/95). The SSL certificate is issued by Google Trust Services, a legitimate provider, which does not mitigate the underlying threat. Technologies detected include Cloudflare Browser Insights, suggesting active monitoring or analytics integration. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP (172.67.145.198) at the network level. Users who interacted with the site should revoke any connected wallet permissions and monitor for unauthorized transactions, as fake crypto card schemes often deploy credential harvesters or wallet drainers. Organizations should update endpoint protection rules to flag domains registered through high-risk registrars like Global Domain Group LLC, particularly those created within the last six months. Given the use of Cloudflare, additional scrutiny of domains with similar infrastructure patterns is recommended to preemptively identify related threats.