asterpool[.]top

Analysis of the domain asterpool.top indicates it was a high-risk phishing site targeting users with a fake Aster airdrop scam. The domain, created on March 11, 2026, resolved to IP 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers bristol.ns.cloudflare.com and zac.ns.cloudflare.com were configured, and the SSL certificate was issued by Let's Encrypt (serial E8). The site's page title, 'Aster airdrop,' directly aligned with its classification as an airdrop scam, a common tactic to deceive cryptocurrency users into disclosing credentials or transferring funds. The domain appeared on four security blocklists and was actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, confirming its malicious intent.

VirusTotal detections from 16 of 91 security vendors further validated its classification as a phishing threat. The registrar, NICENIC INTERNATIONAL GROUP CO., LIMITED, has been associated with other fraudulent domains, though no direct attribution to this specific campaign is confirmed. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk status. As of July 23, 2026, the domain is offline, but defenders should treat any future resolution or reappearance as malicious.

Network-level blocking of 188.114.97.3 and monitoring for related domains using the same registrar or Cloudflare nameservers is recommended. The use of a Let's Encrypt certificate does not indicate legitimacy, as phishing sites frequently exploit free SSL providers to appear trustworthy. No additional brand impersonation or kit details beyond the 'Airdrop Scam' classification were provided, so the exact mechanics of the phishing flow remain unconfirmed. Organizations should correlate this domain with any recent user reports of airdrop-related phishing attempts.