x[.]referencehub[.]store

x.referencehub.store is a recently identified crypto drainer phishing domain classified under generic phishing threats. The domain impersonates legitimate service hubs to deceive users into connecting cryptocurrency wallets, enabling unauthorized fund transfers via malicious JavaScript drainer kits embedded in the site. Security researchers have flagged this domain due to its suspicious behavioral patterns, including fake reward prompts and fraudulent transaction approval interfaces. x.referencehub.store resolves to IP address 188.114.97.3 and operates under Google Trust Services SSL certificates for HTTPS encryption. VirusTotal currently reports 3 out of 95 antivirus engines detecting the domain as malicious, indicating an emerging or undetected threat. The domain was registered through a privacy-protected registrar, obscuring ownership details, and was created recently, per domain age analysis. It remains unflagged in Google Safe Browsing (GSB) and has no presence on major blocklists at this stage. The lack of detection coupled with active infrastructure suggests a developing campaign with high evasion potential. This domain remains active and under investigation by threat intelligence teams. Users are advised to avoid interacting with x.referencehub.store and report any suspicious activity immediately. Security teams should monitor associated IP ranges and SSL certificates for additional infrastructure linked to this campaign. Remaining risk is classified as moderate due to the evolving nature of the threat and current lack of widespread detection. Immediate caution and proactive blocking in enterprise environments is recommended to mitigate potential cryptocurrency theft.