astarfoundation[.]business

The domain astarfoundation.business is currently flagged by multiple threat intelligence sources as a phishing infrastructure. It appears on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services. DNS resolution points the domain to the IPv4 address 104.21.13.191, which is hosted on a cloud content delivery network known to be leveraged by malicious actors for fast‑flux style hosting. A VirusTotal query shows that the domain has been submitted to the service and examined by ninety‑one antivirus and URL scanning engines; none of the engines have raised a detection at the time of analysis, but the absence of a detection does not constitute a safety assurance.

The domain’s registration details, SSL certificate metadata, HTTP response codes, and page title have not been disclosed in the current intelligence set, leaving those aspects unverified. Based on the available evidence, the primary risk vector is credential harvesting through a phishing campaign that uses the domain as a lure. The presence on multiple blocklists and the active blocking by major anti‑phishing platforms indicate that the domain is being used in ongoing malicious operations. Defenders should add the domain to network‑level deny lists, enforce DNS sink‑hole policies, and monitor outbound connections to the associated IP address.

Continuous re‑scanning on VirusTotal and periodic checks against blocklist feeds are recommended to capture any future changes in detection status. Because the hosting provider is a widely used CDN, additional scrutiny of traffic patterns to the IP address may help differentiate legitimate CDN usage from malicious activity. Until further forensic data becomes available, the domain should be treated as high‑risk and blocked in enterprise security controls.