astranovae-hub[.]com

PhishDestroy identifies the active crypto drainer domain astranovae-hub.com, which poses an elevated threat due to its use of a generic phishing lure targeting cryptocurrency users. This domain, created on March 13, 2026, shows no affiliation with any legitimate entity but leverages a common drainer kit designed to siphon funds from victims' wallets upon interaction. The absence of brand impersonation details in current telemetry suggests a broader, opportunistic campaign rather than a targeted brand spoof, though this may evolve as the campaign matures.

This domain resolves to IP 104.21.16.47 and is registered through Dynadot Inc. VirusTotal reports a detection ratio of 17/95 security vendors, indicating partial coverage but not universal recognition of the threat. The domain utilizes a Let's Encrypt SSL certificate, a tactic often employed to appear legitimate to unsuspecting users. As of the latest telemetry, the domain remains unlisted on Google Safe Browsing (GSB) and has not been widely blocked by major threat intelligence platforms, leaving a window of opportunity for threat actors to exploit. The domain's recent creation and active status suggest a rapidly evolving campaign with potential for expansion.

The current status of astranovae-hub.com is active, with no confirmed takedown or mitigation measures in place. PhishDestroy recommends immediate verification of this domain via its threat intelligence platform to prevent exposure to this crypto drainer. Users are advised to exercise extreme caution when encountering links or advertisements promoting astranovae-hub.com or similar domains. While the immediate risk is elevated due to the domain's active status and partial detection coverage, proactive blocking and user awareness remain critical to reducing the attack surface. Remaining risk includes the potential for the domain to be weaponized further or repurposed for additional malicious activities, necessitating ongoing monitoring and rapid response efforts.