astrovisiontrade[.]com

This domain, astrovisiontrade.com, is classified as a high-risk credential harvesting phishing site. Analysis indicates it is actively targeting users through deceptive login interfaces designed to exfiltrate account credentials, payment details, or other sensitive personal information. The threat type is categorized as generic_phishing, with a focus on impersonating legitimate services to trick victims into disclosing confidential data. Infrastructure analysis reveals the domain was registered on September 16, 2025, through Spaceship, Inc., a registrar frequently associated with malicious domains. It resolves to the IP address 194.36.191.196, located in the Netherlands under AS60117 (Host Sailor Ltd), a network segment with a history of hosting phishing infrastructure. The SSL certificate is issued by Let's Encrypt (R12), a common choice for threat actors due to its free and automated issuance process. Detection metrics show the domain is flagged by 1 out of 95 security vendors on VirusTotal, while PhishDestroy has also listed it on their blocklist. Despite minimal detection coverage, the domain remains active, suggesting ongoing malicious operations. Mitigation against this threat requires immediate action from network administrators and end-users. Organizations should block the domain and its associated IP (194.36.191.196) at the firewall or DNS level to prevent access. Users who may have interacted with the site should reset credentials for any accounts entered on the platform, particularly if reused across multiple services. Multi-factor authentication (MFA) should be enforced for all critical accounts to mitigate the impact of credential theft. Additionally, security teams are advised to monitor for indicators of compromise (IOCs) linked to this campaign, including the domain, IP, and SSL certificate thumbprint, to detect potential lateral movement or follow-up attacks.