ciaim-asterdex[.]com

Analysis of the domain ciaim-asterdex.com, created on 21 February 2026 and registered through NiceNIC International Group Co., Limited, shows a high‑risk brand‑impersonation campaign targeting Google. The authoritative nameservers are isaac.ns.cloudflare.com and samara.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. The domain resolves to IP address 172.67.144.242, which belongs to AS13335 Cloudflare, Inc., located in the United States. HTTP traffic is served over Cloudflare with HTTP/3 support, and the TLS certificate presented is issued by Google Trust Services under the identifier WE1, suggesting an attempt to lend legitimacy to the site. When accessed, the server returns HTTP 403, a response that may be used to obscure content from automated crawlers while still delivering malicious payloads to targeted victims.

The page title observed, "YouTubeRU — Смотрите YouTube без зависаний," does not reference the targeted brand directly, but the intelligence flags the domain as impersonating Google and classifies the scam type as Social Media Phishing. VirusTotal analysis shows a single positive detection out of 93 security vendors, confirming that at least one scanner identified malicious behavior. The domain is listed on one external blocklist, PhishDestroy, and both Gridinsoft (0/100) and Scamadviser (1/100) assign the lowest possible trust scores, reinforcing the malicious assessment.

Defenders should block DNS resolution for ciaim-asterdex.com and any subdomains, enforce outbound filtering of connections to the associated IP address, and monitor for HTTP requests that return a 403 status from that IP. Given the Google‑issued certificate, TLS inspection may be required to reveal the underlying content. Continuous monitoring of Cloudflare‑hosted infrastructure linked to this ASN is recommended, as the attacker may shift hosting within the same provider.