votes-asterdex[.]xyz

Analysis of the domain votes-asterdex.xyz, created on 27 February 2026 and currently taken offline, shows that it was operated from the United States under ASN 13335 owned by Cloudflare, Inc. The domain resolved to IP address 104.21.59.41, which is part of Cloudflare’s edge network. Nameserver records list leland.ns.cloudflare.com and nola.ns.cloudflare.com, confirming that the domain relied on Cloudflare’s DNS service. No TLS certificate was observed, indicating that the site served content over plain HTTP. The HTTP response returned a page whose title is exactly “votes-asterdex.xyz/”, providing no additional context about the intended victim or lure.

VirusTotal scanned the domain and two of ninety‑three security vendors flagged it, suggesting that at least a small subset of scanners identified malicious characteristics. The domain is listed on a single public blocklist and has been blocked by the PhishDestroy feed, reinforcing its classification as a phishing‑related resource. The registrar information shows registration through NiceNIC International Group Co., Limited, but no further registration details are publicly disclosed. Evidence points to a generic phishing campaign, but the exact target brand or credential‑stealing technique cannot be confirmed from the available data.

The lack of a TLS certificate, the minimal detection count, and the short lifespan (less than five months before being taken offline) are consistent with a low‑profile, fast‑flux operation aimed at evading rapid takedown. Defenders should continue to monitor the IP 104.21.59.41 and the associated Cloudflare ASN for any resurgence of similar domains, enforce outbound filtering for HTTP traffic to unknown hosts, and incorporate the domain and its IP into internal blocklists. Because the site is already offline, immediate response actions focus on preventing re‑use of the same infrastructure in future phishing attempts.