asterdex-claim[.]xyz

The domain asterdex-claim.xyz was registered on 29 September 2025 via NiceNIC International Group Co., Limited and is currently hosted behind Cloudflare’s network (AS13335) with the IP address 104.21.25.182 located in the United States. The authoritative nameservers javier.ns.cloudflare.com and sara.ns.cloudflare.com resolve to the same Cloudflare edge, indicating the site leveraged the provider’s CDN and DDoS‑mitigation services. No TLS certificate was presented, leaving the connection unencrypted. The site’s HTML title reads “Nur einen Moment…”, a generic phrase that provides no indication of legitimate content.

Malware and URL reputation scanners have flagged the domain; seven of ninety‑five VirusTotal engines reported it as malicious, and Gridinsoft assigned a trust score of 0 / 100. The domain appears on at least one public blocklist, specifically PhishDestroy, which has already listed the URL as a known crypto‑drainer. Analysis of the page’s source code (when it was online) matched the publicly available “Airdrop Scam” phishing kit, a template commonly used to lure cryptocurrency holders into submitting private keys or sending funds to attacker‑controlled wallets. The combination of a recent registration date, lack of HTTPS, low trust score, and association with a known airdrop‑drain kit strongly suggests the domain was created for a short‑lived crypto‑draining campaign.

Because the site is presently taken offline, active mitigation is limited to updating perimeter defenses: add 104.21.25.182 to blocklists, tag the domain and its Cloudflare nameservers as malicious in DNS filtering solutions, and ensure that endpoint URL‑reputation services ingest the VirusTotal detections. Defenders should also monitor for newly registered domains that use the same registrar or Cloudflare nameserver pattern, as threat actors often recycle this infrastructure.