asteroshib[.]com

The domain asteroshib.com was registered on May 15 2026 through NICENIC INTERNATIONAL GROUP CO. LIMITED and remains active with a high risk classification tied to generic phishing. Infrastructure analysis reveals it resolves to IP address 185.158.133.1 located in Germany and employs the nameservers jeremy.ns.cloudflare.com along with nia.ns.cloudflare.com. The site returns HTTP status 200 and presents the page title AsteroShib Marketplace while using an SSL certificate issued under Google Trust Services WE1. Domain creation occurred several weeks prior to the July 12 2026 report date yet the exact operational timeline since registration is not further detailed in the available records.

Detection metrics include appearance on four security blocklists a VirusTotal score of three detections out of ninety five vendors and a trust score of zero out of one hundred from Gridinsoft. The domain is also referenced within a single AlienVault OTX threat intelligence pulse. These indicators collectively support the generic phishing designation though the precise campaign scope or distribution vectors are not enumerated beyond the stated threat type and active status.

Uncertainties center on the full extent of any associated infrastructure or the specific entities targeted since the provided intelligence does not include campaign artifacts or additional linked domains. The continued resolution and lack of takedown as of the report date indicate ongoing accessibility that may require direct observation for confirmation of persistence.

Defenders should add both the domain asteroshib.com and the IP 185.158.133.1 to internal block lists and filters. Monitoring for additional registrations under the same nameservers or registrar patterns is advised along with review of network logs for any connections to the known IP. Regular updates to threat intelligence feeds incorporating the VirusTotal and blocklist signals can further reduce exposure to similar infrastructure.