aeoraster[.]xyz

Analysis indicates that the domain aeoraster.xyz, registered on 21 February 2026 through NiceNIC International Group Co., Limited, is currently active and hosts a generic phishing page identified by the title “Just a moment…”. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 operated by Cloudflare, Inc., and the domain is served from Cloudflare with HTTP/3 enabled. The authoritative name servers are peaches.ns.cloudflare.com and walt.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint despite the malicious intent.

Security telemetry shows that two of ninety‑three VirusTotal scanners have flagged the domain, and it is listed on one external blocklist. The site returns an HTTP 403 status code, which may be employed to conceal malicious content behind a challenge page. Independent monitoring by PhishDestroy records the domain as blocked, and the Gridinsoft trust score is 0 out of 100, reflecting a highly untrusted rating.

The available evidence confirms that aeoraster.xyz is being used for phishing, but the specific target brand, credential collection method, and payload are not disclosed in the current data set. Defenders should proactively block the domain at DNS or proxy layers, monitor outbound connections to the associated Cloudflare IP, and update intrusion‑prevention signatures to include the observed indicators of compromise. Continuous re‑inspection of the site’s content is recommended to capture any evolution of the phishing campaign.