hubrotator[.]link

PhishDestroy has identified hubrotator.link as an active crypto drainer impersonating a login interface. The domain, registered on July 06, 2025 via Namecheap, leverages a Google Trust Services SSL certificate to enhance legitimacy, a tactic commonly exploited in credential-harvesting campaigns. While the exact drainer kit remains under analysis, the domain's configuration suggests an automated script designed to capture and exfiltrate wallet credentials or seed phrases.

Technical indicators confirm this threat is still in its early stages. VirusTotal reports 2/95 detections, indicating no AV coverage, while passive DNS reveals resolution to IP 104.21.53.140. The domain was flagged by PhishDestroy within hours of creation, with no prior associations in threat intelligence feeds. Google Safe Browsing (GSB) has not yet blacklisted this domain, and blocklist counts remain at zero, though this could change rapidly as reports escalate.

The domain remains active as of this advisory, with status marked as 'active' and risk classified as 'under_investigation'. Immediate action is recommended to block traffic to 104.21.53.140 and monitor for related artifacts. Users should exercise extreme caution when accessing domains registered in the past 30 days and verify unknown login portals on PhishDestroy. Remaining risk is moderate due to the domain's newness and lack of widespread detection, but the potential for rapid escalation is significant given the unblocked status.