asterdex-clalm[.]com

The domain asterdex-clalm.com was registered on October 19, 2025 through NiceNIC International Group Co., Limited and is currently taken offline. Analysis of public records shows the site was hosted behind Cloudflare, using HTTP/3, and resolved to IP address 172.67.188.94, which belongs to AS13335 Cloudflare, Inc. in the United States. The SSL certificate presented by the server was issued by Google Trust Services under the WE1 designation, indicating a valid TLS chain but offering no assurance of legitimacy. DNS configuration lists everton.ns.cloudflare.com and kehlani.ns.cloudflare.com as authoritative nameservers.

When accessed, the HTTP response returned a 403 status code, suggesting the content is not publicly reachable at the time of testing. The page title captured from prior snapshots reads "Aster airdrop," aligning with the identified phishing kit labeled as an Airdrop Scam and the broader classification of a fake airdrop scheme. Threat intelligence feeds have flagged the domain on three security blocklists, and it has been blocked by protective services including PhishDestroy, MetaMask, and SEAL. VirusTotal scans recorded 15 detections out of 93 security vendors, reinforcing the malicious assessment.

While the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, the convergence of a targeted airdrop lure, known phishing kit, and multiple vendor detections indicates a high‑risk profile. Defenders should continue to block the domain at network and endpoint layers, monitor for any resurgence of activity from the associated IP address, and update URL filtering rules to include the observed nameservers and SSL fingerprint. Incident response teams should also consider reviewing any recent user reports of unsolicited airdrop offers that reference the "Aster" branding, as these may be attempts to exploit the same campaign infrastructure.