aster-dex[.]ink

Analysis indicates that the domain aster-dex.ink was registered on September 22, 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 188.114.96.3 located in the United States. The domain resolves to two Cloudflare nameservers, amit.ns.cloudflare.com and kimora.ns.cloudflare.com, and does not present an SSL certificate, leaving traffic unencrypted. The page title returned by the live host before takedown reads “Aster - The next‑gen perp DEX for all traders”, which aligns with the reported scam type of brand impersonation targeting the “across” brand. Gridinsoft assigns a trust score of 0 / 100, reflecting extreme suspicion.

VirusTotal scans have flagged the domain in six out of ninety‑five security engines, and AlienVault OTX lists the domain in a single threat‑intel pulse. The site has been added to at least one public blocklist and was previously blocked by the PhishDestroy service. Current status is offline, indicating that the malicious content has been removed or the host has been taken down. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been delivered, as no detailed page content or HTTP response codes are available.

The lack of an SSL certificate and the short lifespan of the domain suggest a typical fast‑flux impersonation campaign, but further forensic capture would be required to confirm any active exploitation. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host header or IP address, and add the IP 188.114.96.3 to reputation‑based deny lists. Organizations that reference the “across” brand should alert users to the existence of this impersonation attempt and reinforce verification of legitimate URLs.