asteroidsol[.]live

This domain, asteroidsol.live, is flagged as an active phishing endpoint with high-risk indicators as of July 13, 2026. Infrastructure analysis reveals the domain was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 188.114.96.3, which is associated with Cloudflare, Inc. in Canada. The domain employs Cloudflare nameservers (june.ns.cloudflare.com and nikon.ns.cloudflare.com) and presents a Let's Encrypt SSL certificate (E7), a common configuration for both legitimate and malicious sites leveraging Cloudflare's infrastructure. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating prior detection as malicious. AlienVault OTX records the domain in 22 threat intelligence pulses, further corroborating its association with phishing activity. While VirusTotal reports 9 of 94 security vendors flagging the domain, this detection rate alone does not confirm the specific nature of the threat but aligns with broader abuse patterns. The HTTP response code is 403 (Forbidden), and the page title is 'Just a moment...', a generic Cloudflare interstitial that often appears during bot challenges or when access is restricted. This behavior is consistent with phishing sites attempting to evade automated scans or restrict access to targeted victims. The exact content or target of the phishing campaign is not yet analyzed, as no brand or scam type is explicitly identified in the available data. Defenders should treat this domain as malicious and implement blocking at the DNS or network level. Given its Cloudflare hosting, additional scrutiny of related domains or IPs within the same infrastructure may be warranted to identify connected threats. Monitoring for changes in HTTP status or page content could provide further insights into the campaign's evolution.