aster-exchange[.]com

The domain aster-exchange.com was registered with NameCheap on 28 September 2025 and resolves to the IP address 198.54.115.157, which is owned by AS22612 (Namecheap, Inc.) in the United States. No TLS certificate is presented and the site currently returns an offline HTTP status, indicating that the hosting service has been taken down. The page title observed before takedown reads “Aster – The next‑gen perp DEX for all traders,” suggesting a counterfeit front for a decentralized exchange platform. Intelligence sources label the operation as a Wallet/Seed Phishing campaign that impersonates the broad “across” brand space.

Ten of ninety‑five VirusTotal scanners flagged the domain as malicious, and Gridinsoft assigned a trust score of 0 / 100. The domain appears on at least one public blocklist and is listed by PhishDestroy as a blocked indicator. An AlienVault OTX pulse also references the domain, confirming that it has been shared within the threat‑intel community. Nameserver records point to dns1.namecheaphosting.com and dns2.namecheaphosting.com, both typical of NameCheap‑hosted infrastructure.

Analysis indicates that the primary malicious objective is likely the collection of cryptocurrency wallet credentials or seed phrases, leveraging the deceptive DEX‑oriented title to lure traders. Because the site is presently offline, immediate disruption has been achieved, but the underlying registration and hosting patterns remain active and could be reused for future campaigns. Defensive teams should add 198.54.115.157 and the domain aster‑exchange.com to network and DNS blocklists, monitor NameCheap registration windows for similarly patterned domains, and enforce endpoint controls that detect wallet‑seed entry attempts. Continuous review of threat‑intel feeds, including AlienVault OTX and PhishDestroy updates, will help surface re‑emergence of this indicator.