auracas[.]com

The domain auracas.com was registered on June 16, 2025 through Web Commerce Communications Limited and is currently taken offline. Technical resolution points to IP address 69.5.189.58, which belongs to AS42624 Global-Data System IT Corporation and is geolocated in Switzerland (CH). No SSL certificate is presented, indicating an unencrypted HTTP service when the site was active. The page title observed during the brief crawl reads "AURACAS | Play at the best online casino based on Blockchain," matching the declared scam type of a crypto‑focused casino scheme.

Analysis links the site to the publicly known Gambler Scam phishing kit, confirming its use in fraudulent gambling or cryptocurrency lure campaigns. Reputation services rate the domain extremely poorly: Gridinsoft assigns a trust score of 1 / 100, Scamadviser also reports 1 / 100, and the domain appears on one security blocklist. VirusTotal scans show three of ninety‑five security vendors flagging the domain, reinforcing the malicious assessment. AlienVault OTX references the domain in a single threat‑intel pulse, and PhishDestroy lists it as blocked.

Nameservers are ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, and ns4.nameserver, all typical of low‑cost hosting. The limited visibility—only a single snapshot before takedown—leaves the full extent of the payload and victim targeting unknown, but the convergence of low trust scores, blocklist inclusion, kit attribution, and vendor detections provides strong evidence of a phishing operation. Defenders should immediately block auracas.com and its resolving IP 69.5.189.58 at perimeter and DNS layers, monitor for newly registered domains using the same registrar or similar name‑server patterns, and update detection rules to flag the Gambler Scam kit signatures. Continuous threat‑intel feeds should be consulted for any re‑appearance of the kit or related crypto‑casino lures.