kaspahub[.]org

Analysis of the domain kaspahub.org indicates it is an active phishing site targeting users associated with cryptocurrency services, specifically impersonating the Kaspa ecosystem as suggested by the page title 'Kaspa Hub' and the domain name. The domain was registered on June 1, 2025, through NameCheap, Inc., and currently resolves to the IP address 172.67.177.51. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which are commonly employed to obfuscate the origin and enhance the performance of malicious sites. As of July 12, 2026, the domain appears on two security blocklists and has been referenced in 24 threat intelligence pulses on AlienVault OTX, suggesting prior detection by security researchers. Despite these indicators, the domain has not been flagged by any of the 95 vendors in a recent scan, though this absence does not confirm its safety. The domain is actively blocked by at least two security platforms, further supporting its classification as malicious. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the site's content. The domain's creation over a year ago, combined with its continued activity, suggests it may be part of a persistent campaign rather than a short-lived operation. Defenders are advised to treat this domain as high-risk, particularly within environments where cryptocurrency-related activity occurs. Monitoring for connections to 172.67.177.51 and associated domains registered through the same registrar may help identify related infrastructure. The exact nature of the phishing mechanism remains unconfirmed, as the site's content has not been fully analysed.