astar-apps[.]web[.]app

PhishDestroy has identified a high-risk brand impersonation campaign targeting Discord users through the domain astar-apps.web.app. This domain masquerades as a legitimate Discord-branded portal, specifically mimicking the Astar Network's Assets portal, to deceive users into connecting their cryptocurrency wallets. Once connected, a crypto drainer kit is deployed to steal funds and digital assets. The threat is classified as brand impersonation with a high risk level, and it remains active as of analysis.

Technical indicators paint a clear picture of malicious intent. VirusTotal flags this domain with 7 out of 95 security vendors detecting it as malicious. The domain was registered through Google LLC and resolves to IP address 199.36.158.100. It currently appears on 1 security blocklist, and the page title is "Assets | Astar Portal - Astar Network," furthering the deception. Notably, Google Safe Browsing has not yet flagged this domain, which may allow it to evade initial detection by some users.

As of now, astar-apps.web.app is still active and operational, posing an ongoing risk to Discord users. PhishDestroy recommends avoiding any interaction with this domain and never connecting a cryptocurrency wallet to it. Users who may have been exposed should immediately revoke any permissions granted and transfer assets to a secure wallet. PhishDestroy continues to monitor this threat and will update the advisory if the domain is taken down or escalates further.