astardex[.]org

This domain, astardex.org, is identified as an active phishing infrastructure designed to harvest cryptocurrency wallet credentials. Analysis indicates the site mimics legitimate decentralized exchange interfaces to deceive users into entering private keys or seed phrases, enabling unauthorized access to digital assets. The threat actor employs social engineering tactics, including fake token swaps or airdrop claims, to lure victims into interacting with the malicious interface. Given the domain's focus on cryptocurrency theft, the risk level is classified as high due to the irreversible nature of blockchain transactions and the potential for significant financial loss. Infrastructure analysis reveals the domain was registered on June 24, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. Despite its recent creation, astardex.org has been flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating prior detection by industry monitoring systems. The domain resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), a common obfuscation tactic to conceal the true origin of the phishing server. Notably, VirusTotal reports 0 out of 95 security vendors currently detecting the domain as malicious, suggesting the campaign may still evade some automated detection mechanisms. Users who have visited astardex.org or entered sensitive information on the site should immediately cease all interactions and take corrective actions. First, revoke any connected wallet authorizations using a trusted blockchain explorer or wallet management tool. Second, transfer remaining assets to a new wallet with a freshly generated seed phrase, as the existing credentials may be compromised. Third, monitor all linked accounts for unauthorized transactions and report the incident to relevant blockchain security teams. Due to the domain's active status and lack of widespread detection, users are advised to verify the legitimacy of any cryptocurrency-related website before interacting with it, particularly those promoting unsolicited airdrops or token swaps.