aster-dex[.]uk

Analysis of aster-dex.uk indicates a deliberately crafted phishing infrastructure that leverages reputable cloud services to obscure its origin. The domain resolves to IP address 104.21.82.209, which belongs to Cloudflare’s AS13335 network and is hosted in the United States. DNS resolution is provided by Cloudflare name servers logan.ns.cloudflare.com and wanda.ns.cloudflare.com, confirming that the site is protected by Cloudflare’s edge network and supports HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 identifier, providing a valid HTTPS connection that can appear legitimate to end users.

Registration data shows the domain was created on September 21, 2025 through Name.com, and the current status is taken offline, suggesting the operators may be pausing activity or awaiting a new campaign launch. Threat intelligence marks the domain as a brand‑impersonation phishing site: it appears on one security blocklist, is actively blocked by PhishDestroy, and is referenced in a single AlienVault OTX pulse. VirusTotal scans show twelve of ninety‑five security vendors flag the domain, reinforcing the suspicion of malicious intent.

The page title "Aster DEX - Next-Generation Trading Platform" implies a financial‑services theme, yet no further page content has been captured, leaving the exact phishing lure unknown. Defenders should immediately block aster-dex.uk at the DNS and proxy layers, add the associated Cloudflare IP to network‑level deny lists, and ensure endpoint and web‑gateway solutions are updated with the latest phishing feeds. Continuous monitoring of the domain’s registration status and any re‑appearance of the IP or certificate is advised, as re‑hosting on the same Cloudflare edge could occur without notice.