specter-lab[.]org

On 24 July 2026, the domain specter-lab.org was observed delivering a wallet/seed phishing campaign that impersonates the Across brand. The site was registered on 21 February 2026 and resolves to the IPv4 address 173.252.167.40, which is hosted in the United States under AS19853 (OrangeHost). The TLS certificate presented is identified as R11, indicating a valid‑looking SSL configuration. The page title returned by the web server is "SPECTER DRAINER - ETH | SOL | TRON | TON | NFT | EVM", suggesting the page attempts to lure victims into providing private keys for multiple blockchain networks. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy.

AlienVault OTX has referenced specter-lab.org in one threat‑intelligence pulse, confirming its recognition by the broader security community. VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain as malicious, providing additional corroboration of its harmful intent. The current operational status is listed as offline, which may indicate that the phishing infrastructure has been taken down or is temporarily inactive. Defenders should ingest the observable indicators into their detection stacks. The IPv4 address 173.252.167.40 and the ASN AS19853 should be added to network‑level deny lists.

Domain‑level controls, such as DNS sink‑holing or block‑list enforcement, should be updated to include specter-lab.org. Monitoring for newly registered domains that share the same registrar or exhibit similar SSL characteristics (R11) may help pre‑empt replication attempts. Because the site targets cryptocurrency wallets across multiple chains, endpoint security policies that flag attempts to submit seed phrases or private keys to unknown URLs should be reinforced. Finally, analysts should continue to track any re‑appearance of the domain or associated infrastructure in future threat‑intel feeds, especially additional OTX pulses or VirusTotal submissions.