asterfoundation.run — Cloudflare-Hosted Phishing Domain Report

This domain, asterfoundation.run, was registered on May 7, 2026, through a registrar commonly associated with high-risk domains. Analysis indicates the domain is actively serving content but currently returns an HTTP 403 status, suggesting access restrictions or a staging phase for malicious activity. The domain is hosted behind Cloudflare infrastructure, resolving to IP address 172.67.203.29, which is geolocated in Canada. Nameservers point to Cloudflare, a pattern frequently observed in phishing campaigns due to the provider's privacy and proxy services. The domain appears on three security blocklists and is flagged by multiple threat intelligence sources, including a pulse in AlienVault OTX. Three out of ninety-five security vendors on VirusTotal have detected the domain as malicious, reinforcing its classification as a high-risk phishing threat. The SSL certificate, issued by Let's Encrypt, is valid but does not mitigate the domain's malicious intent, as free certificates are routinely exploited in phishing operations. Defenders should treat this domain as an active threat. The combination of recent registration, Cloudflare hosting, and blocklist presence aligns with known phishing infrastructure. While the exact target or brand impersonation remains unclear, the domain's inclusion in multiple threat feeds justifies immediate blocking at the network and endpoint levels. Monitoring for changes in HTTP status or new subdomains is recommended, as the domain may transition to an active phishing page. No legitimate use case has been identified, and the domain should be considered compromised until further evidence suggests otherwise.