freehoroscope[.]ca

PhishDestroy identifies freehoroscope.ca as an active crypto drainer domain designed to trick users into connecting cryptocurrency wallets and draining funds. The site impersonates legitimate horoscope services to harvest private keys and transaction approvals from unsuspecting visitors. Security researchers have confirmed malicious payloads that interact with Web3 wallet browser extensions and prompt fraudulent signature requests. Users who interact with this domain risk immediate loss of digital assets with no recovery options. This domain was flagged by 6 out of 95 VirusTotal security vendors, placing it on one mainstream blocklist. It resolves to IP address 45.42.212.150 and uses a Let's Encrypt SSL certificate. Registered through Go Daddy Domains Canada, Inc on November 3, 2003, the domain has existed for over two decades but recently converted to malicious operations. The age and legitimate-appearing registration details make this threat particularly deceptive for non-technical users who might trust older domains. Anyone who visited freehoroscope.ca should immediately disconnect their cryptocurrency wallet from the site, revoke any permissions granted, and transfer remaining funds to a clean wallet. Check browser extension permissions and scan devices for malware. Report the domain to PhishDestroy with transaction hashes if any transfers occurred. Avoid using this domain for any purpose, as all cryptocurrency interactions should be considered compromised.