asrdtedex[.]com

Analysis of asrdtedex.com, observed on July 23 2026, indicates that the domain is being used to host a counterfeit cryptocurrency airdrop campaign. The site presented the page title “Aster airdrop”, consistent with a fake‑airdrop lure. Registration data shows the domain was created on 5 October 2025 through NiceNIC International Group Co., Limited, and the authoritative name servers are sima.ns.cloudflare.com and theo.ns.cloudflare.com, both under Cloudflare’s infrastructure. DNS resolution points to IP address 104.21.75.196, which belongs to ASN 13335 operated by Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming that HTTPS is provided by a legitimate certificate authority, but this does not guarantee content safety.

Multiple security‑focused services have already taken action. The domain is listed on four blocklists and has been blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal analysis shows that 16 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of phishing activity. The identified phishing kit is labelled “Airdrop Scam”, and the overall scam type is recorded as “Fake Airdrop”. The site currently reports an offline status, suggesting that the operators have withdrawn the malicious content or migrated elsewhere.

Technical fingerprints reveal the use of Cloudflare’s CDN and support for HTTP/3, a common choice for fast delivery but also for obscuring attacker infrastructure. No additional evidence such as login forms or credential harvesting pages is available in the provided data, leaving the exact payload unknown. However, the convergence of a deceptive page title, recent domain creation, high‑profile blocklist listings, and detection by multiple vendors provides a strong indicator of a targeted phishing operation aimed at cryptocurrency users. Defenders should continue to block asrdtedex.