aster-login-enn-coo[.]pages[.]dev

Analysis of the domain aster-login-enn-coo.pages.dev, which was taken offline as of the report date, shows multiple indicators of malicious activity. The site was hosted on Cloudflare, Inc., as evidenced by the registrar entry and the resolution to IP address 172.66.44.126, which belongs to AS13335 Cloudflare in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 root, a legitimate certificate authority, but the presence of a valid certificate does not guarantee safety. HTTP responses return a 403 status code, suggesting that the page is no longer publicly reachable, consistent with the offline status. Security scanners on VirusTotal recorded 11 detections out of 93 submitted vendors, indicating that a subset of anti‑malware products identify the domain as malicious.

Google Safe Browsing classifies the URL as a social engineering threat, and PhishDestroy has added it to its blocklist. An additional blocklist entry is recorded, and the Gridinsoft trust score is 0 out of 100, reinforcing the high‑risk assessment. The page title captured during the brief live period references “AsterWallet, Aster Network, Astar Network Login | Access AsterWallet, Aster Netw”, which is unrelated to the advertised brand. Nonetheless, the intelligence flags the domain as an impersonation of Apple, aligning it with a tech‑support scam profile.

The domain was created on September 2, 2020, and uses Cloudflare’s default name servers (adi.ns.cloudflare.com, eleanor.ns.cloudflare.com, karl.ns.cloudflare.com, quinton.n...), further confirming the use of Cloudflare’s infrastructure. Defenders should block traffic to the resolved IP 172.66.44.126, enforce domain‑level blocking in DNS filtering solutions, and add the domain to web proxy allow‑list exclusions. Monitoring for similar sub‑domains under the *.pages.dev suffix is advised, as attackers often reuse the same hosting provider and certificate chain.