astoriacapitallimited[.]com

This domain, astoriacapitallimited.com, poses as a legitimate investment platform to deceive users into disclosing sensitive financial information or login credentials. Analysis indicates the site mimics a professional financial services portal, complete with interactive elements like particles.js and Smartsupp chat integration, which are commonly used to create an illusion of authenticity. The threat is designed to capture personal and financial data under false pretenses, potentially leading to unauthorized account access or financial fraud. Infrastructure analysis reveals multiple red flags confirming its malicious intent. The domain is flagged by 9 out of 95 security vendors on VirusTotal, and it appears on two security blocklists, including PhishDestroy and OISD. It was registered through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with high-risk domains. The site resolves to the IP address 86.107.77.178 and uses a Let's Encrypt SSL certificate, which, while providing encryption, is often exploited by threat actors to lend credibility to fraudulent sites. If you have visited astoriacapitallimited.com or entered any information on the site, immediate action is required. First, cease all interaction with the domain and disconnect any devices used to access it from networks to prevent potential malware spread. Next, change passwords for any accounts that may have been exposed, prioritizing financial and email accounts, and enable multi-factor authentication where available. Monitor accounts for unauthorized transactions or suspicious activity, and consider reporting the incident to relevant financial institutions or cybersecurity authorities. Users should also scan their devices for malware using updated security tools to detect any secondary threats.