asterdexx[.]xyz

The domain asterdexx.xyz was observed hosting a generic phishing page with the title "Et øjeblik …". The site was taken offline prior to the report date of 25 July 2026. Registration data show the domain was created on 3 November 2025 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Both authoritative nameservers, heidi.ns.cloudflare.com and jay.ns.cloudflare.com, are Cloudflare‑managed, indicating the attacker leveraged Cloudflare’s CDN and protection services.

No SSL certificate was presented at the time of analysis, and the site lacked HTTPS encryption. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 out of 100, and Scamadviser rates it 1 out of 100, reflecting a high likelihood of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal analysis reports that five of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious activity.

The available evidence confirms that the domain was used for phishing, but the specific target or credential‑capture mechanism cannot be confirmed from the limited page title. Defenders should continue to block the domain at perimeter and DNS filters, monitor for any re‑registration attempts, and consider adding the IPv6 address to threat intelligence feeds. Ongoing observation of Cloudflare‑associated IP ranges for similar patterns is advisable, as the attacker may relocate to a different address within the same ASN. Because the site is already offline, immediate incident response actions are limited to ensuring that any cached artifacts are purged and that user education campaigns reference the observed "Et øjeblik …" title to aid detection of related future campaigns.