aster-network[.]xyz

Analysis of the domain aster-network.xyz indicates it was actively impersonating the Sei brand, a cryptocurrency-related platform, as confirmed by its classification under 'brand impersonation' and explicit targeting of Sei in available intelligence. The domain was registered on September 29, 2025, through NiceNIC International Group Co., Limited, and resolved to the IP address 172.67.143.141, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers adele.ns.cloudflare.com and alberto.ns.cloudflare.com were in use, and no SSL certificate was detected, increasing the likelihood of unencrypted malicious traffic. At the time of assessment, the domain was flagged by 5 of 95 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in the available data.

It appeared on one security blocklist and was proactively blocked by PhishDestroy. The page title 'Just a moment...' suggests a Cloudflare interstitial or a placeholder, which may indicate recent takedown efforts or evasion techniques. The domain is currently offline, but its infrastructure remains a potential vector for future malicious activity. Defenders should treat this domain as a confirmed brand impersonation threat targeting Sei users.

The use of Cloudflare hosting is consistent with adversaries attempting to obscure origin infrastructure, and the lack of SSL further supports its classification as high-risk. While the domain is offline, monitoring for re-registration or IP reuse is recommended. If internal logs show connections to 172.67.143.141 or DNS queries for aster-network.xyz, investigate for potential credential theft, wallet-draining activity, or unauthorized access tied to Sei-related services. No additional scam mechanics (e.g., fake login portals, transaction pages) were confirmed in the available data.