astroxcinvest[.]com

Analysis indicates that astroxcinvest.com was registered on 17 October 2024 through the TUCOWS.COM registrar located in Colombia. The domain resolves to the IPv4 address 216.158.229.243 and uses the authoritative nameservers da900a.trouble-free.net and da900b.trouble-free.net. VirusTotal has recorded detections from three of ninety‑one scanned scanners, confirming that at least a subset of security engines consider the domain malicious. The PhishDestroy blocklist currently lists the domain, and it appears on an additional security blocklist, giving a total of one external blocklist entry. The domain is classified as a generic phishing site with a high risk rating and remains active as of the report date, 27 July 2026.

The available telemetry does not include HTTPS certificate details, HTTP response codes, page title, or any observed payload. Consequently, the specific lure or credential‑harvesting technique employed by the site cannot be confirmed beyond the generic phishing label. The limited detection count suggests that the site may be employing evasive techniques or that it is newly observed by the majority of scanners. Defenders should prioritize immediate containment measures. Network‑level controls ought to block DNS resolution for astroxcinvest.com and its associated IP address 216.158.229.243.

Email gateways should be configured to reject or quarantine messages containing URLs that resolve to this domain. Adding the domain and its nameservers to intrusion‑prevention and web‑filtering policies will reduce exposure. Continuous monitoring of the IP space and periodic re‑scanning on VirusTotal or similar platforms are recommended to capture any changes in the detection profile. Incident response teams should also consider outreach to the registrar TUCOWS.COM for potential takedown actions, given the active status of the infrastructure.