asterdexc[.]xyz

Analysis of asterdexc.xyz shows a short‑lived domain that was created on 21 February 2026 and is presently taken offline. The domain resolves to the IP address 172.67.158.238, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No SSL certificate is presented for the site, indicating that HTTPS was not configured at the time of observation. The authoritative name servers listed are cheryl.ns.cloudflare.com and gordon.ns.cloudflare.com, both operated by Cloudflare, confirming the use of the provider’s DNS infrastructure.

Registration was performed through NiceNIC International Group Co., Limited, a registrar that frequently appears in threat‑intel feeds. The page title returned by the server is the generic string "Just a moment...", offering no insight into the intended victim interaction. VirusTotal scans have flagged the domain in 11 of 93 security vendor checks, and the domain appears on a single public blocklist. Additionally, PhishDestroy has listed the domain as blocked, reinforcing the classification as a phishing vector.

The evidence set therefore includes IP ownership, registrar data, lack of TLS, minimal page‑title information, and multiple independent detections. Uncertainties remain regarding the specific lure or credential‑harvesting page that may have been served before the site was taken offline, as no content snapshots or behavioral logs are available. Defenders should add asterdexc.xyz to network‑level deny lists, enforce DNS filtering against the identified blocklist, and monitor Cloudflare‑associated IP ranges for any re‑use of the same address. Continuous re‑scanning of the domain is advised in case the site is re‑activated, and any future detection should be correlated with the existing infrastructure footprint to accelerate response actions.