unlock-asterdex[.]xyz

Analysis of unlock-asterdex.xyz indicates this domain was part of a phishing infrastructure targeting cryptocurrency users. The domain was registered on March 6, 2026, through NiceNIC International Group Co., Limited and resolved to 188.114.97.3, an IP address assigned to Cloudflare, Inc. (AS13335). Nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com were in use, consistent with Cloudflare proxying. No SSL certificate was detected at the time of assessment, and the page title returned was 'Just a moment...', a default response often associated with Cloudflare-protected sites awaiting verification or serving interstitial pages.

The domain appears on three security blocklists and is flagged by four of 94 security vendors on VirusTotal, including PhishDestroy, MetaMask, and SEAL. These detections align with its classification as a crypto-related phishing threat, though the exact nature of the scam—whether a wallet drainer, fake exchange, or credential harvester—remains unconfirmed due to the lack of detailed page content analysis. The domain was taken offline by July 24, 2026, but defenders should treat any prior resolution to 188.114.97.3 or association with the nameservers as indicators of compromise. No brand-specific targeting is evident from the available data, and the page title does not reveal the intended victim or service being mimicked.

The use of Cloudflare infrastructure is common among phishing operators to obscure hosting details and evade takedowns. Defenders are advised to review logs for connections to 188.114.97.3 or DNS queries for unlock-asterdex.xyz, particularly from systems handling cryptocurrency transactions. If internal telemetry confirms user interaction with this domain, assume credential or wallet compromise and initiate response procedures. Given the domain’s offline status, further forensic evidence may be limited, but historical resolutions and associated infrastructure should be monitored for reactivation.