gov-asterdex[.]com

Analysis of gov-asterdex.com, first observed on February 22, 2026, indicates that the domain is being used for a brand‑impersonation campaign targeting the x.com brand. The domain is registered through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 104.21.40.118, which is associated with ASN 13335 in the United States. Both authoritative nameservers, kyle.ns.cloudflare.com and lilyana.ns.cloudflare.com, belong to Cloudflare’s DNS infrastructure, suggesting the operator is leveraging Cloudflare’s CDN and protection services. No SSL certificate is presented for the site, and the Gridinsoft trust score is 0 out of 100, reflecting a lack of reputation.

The page that was captured displays the title "Just a moment…", a generic placeholder that offers no indication of the intended malicious payload. VirusTotal scans have recorded three detections out of ninety‑five AV engines, and the domain appears on three public blocklists, specifically PhishDestroy, MetaMask, and SEAL, confirming that multiple security vendors have flagged it as malicious. The elevated risk rating aligns with the observed evidence, although the site is currently offline, limiting real‑time verification of payload content. Defenders should continue to block the domain at network perimeter and DNS resolvers, monitor for any resurgence of the host under the same IP or similar Cloudflare‑hosted subdomains, and consider adding the domain to internal blacklists.

Because the registration date is recent and the infrastructure relies on a shared Cloudflare IP, future campaigns may reuse the same hosting environment; therefore, threat‑intel feeds should be refreshed regularly. At this stage, the primary indicators of compromise are the domain name, its IP address, the registrar, the lack of TLS, the low trust score, the specific blocklist entries, and the three VirusTotal detections.