astar[.]qpon

Analysis of the domain astar.qpon indicates active phishing infrastructure with high-risk characteristics as of July 25, 2026. The domain is flagged by 3 of 91 security vendors on VirusTotal, though this detection rate alone does not confirm malicious intent without additional context. It appears on one security blocklist and is actively blocked by PhishDestroy, suggesting prior abuse reports or heuristic detection. The domain returns an HTTP 403 status, which may indicate restricted access or defensive measures to prevent casual inspection, a common tactic in phishing operations to evade automated crawlers.

Infrastructure analysis reveals the domain is registered through Dynadot Inc and uses Cloudflare nameservers (carter.ns.cloudflare.com and meiling.ns.cloudflare.com). Cloudflare's services are frequently leveraged by threat actors to obscure hosting origins and protect phishing pages from takedowns. The domain remains active, with no evidence of suspension or sinkholing.

No specific brand, scam type, or phishing kit has been identified in the available data, and the exact content of the site is not yet analyzed. Defenders should treat this domain as high-risk due to its blocklist presence, Cloudflare hosting, and HTTP 403 status, which aligns with known phishing infrastructure patterns. Further investigation, including SSL certificate analysis and historical DNS records, is recommended to determine the full scope of its use.