xk7p-static-cdn-v2-prod[.]pages[.]dev

This domain, xk7p-static-cdn-v2-prod.pages.dev, is flagged as a high-risk phishing portal targeting cryptocurrency users. Analysis of the page title, 'Sign in - Aster DEX,' indicates an attempt to impersonate a decentralized exchange platform, likely to harvest wallet credentials or private keys. The domain appears to be part of a broader phishing campaign leveraging static content delivery networks to evade detection, though no specific drainer kit signatures have been confirmed at this time. Infrastructure analysis reveals several critical technical indicators. The domain resolves to the IP address 188.114.96.3, hosted by Cloudflare, Inc., with an SSL certificate issued by Google Trust Services (WE1). It was registered on April 03, 2026, suggesting either a typo-squatting attempt or a preemptive registration for malicious use. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain is currently not listed in Google Safe Browsing databases, though this may reflect a lag in detection rather than a clean status. As of the latest assessment, the domain remains active and continues to pose a significant risk to users. The use of Cloudflare infrastructure complicates takedown efforts, as the hosting provider’s distributed network can obscure the true origin of the malicious content. Users are advised to avoid interacting with the domain, and organizations should implement network-level blocks on the IP 188.114.96.3 to mitigate exposure. Given the domain’s high-risk classification and active status, continuous monitoring is recommended to track any shifts in its behavior or infrastructure.