portal-asterdex[.]net

Portal-asterdex.net was observed by the investigative team on July 24, 2026 as part of a generic phishing campaign. DNS resolution returns the single IPv4 address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The domain was registered on December 12, 2025 through NiceNIC International Group Co., Limited, indicating a relatively recent creation date typical of transient malicious infrastructure. HTTP requests to the host return a 403 status code, suggesting that the site is currently inaccessible or deliberately restricted. The TLS certificate presented by the server is issued by Google Trust Services under the WE1 designation, confirming that the domain is using a valid SSL chain despite its malicious purpose.

Passive technology profiling identifies Cloudflare as the CDN and DNS provider, consistent with the observed nameservers carol.ns.cloudflare.com and etienne.ns.cloudflare.com. VirusTotal analysis shows that 7 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of phishing activity. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of reputation. The page title returned by the server is “Un momento…”, which provides no additional context about the intended victim or lure. The domain has been added to a single security blocklist and is currently listed as taken offline by PhishDestroy.

No further public indicators, such as additional blocklist appearances or Safe Browsing alerts, are available at this time. Given the limited but consistent evidence, defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the 188.114.96.3 address, and consider adding the domain to internal deny lists. Analysts should also watch for new domains registered by the same registrar or using the same Cloudflare nameservers, as threat actors often recycle these components.