asterdexi[.]wiki

Analysis of asterdexi.wiki indicates a confirmed wallet-seed phishing domain targeting the Across decentralized exchange brand. The domain was registered on November 6, 2025, through NiceNIC International Group Co., Limited, and is currently offline. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers marissa.ns.cloudflare.com and thaddeus.ns.cloudflare.com, resolving to IP 172.67.190.188 in the United States. No SSL certificate is present, increasing exposure to interception risks. The site's page title, 'Aster DEX Review 2025 – Is It Worth The Hype?', suggests an attempt to impersonate a legitimate DEX review while harvesting wallet credentials or seed phrases.

Security vendors have flagged this domain on five blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. Gridinsoft assigns a trust score of 0/100, reinforcing its fraudulent classification. While VirusTotal shows only one detection, this does not imply safety—absence of broader scanning does not confirm legitimacy. The domain's rapid takedown aligns with typical phishing lifecycle patterns, where malicious sites are removed after detection or after achieving their objective.

Defenders should treat asterdexi.wiki as a confirmed threat vector for Across users. Blocklist integration at the DNS and network level is recommended, alongside monitoring for related domains using similar naming conventions or Cloudflare infrastructure. Given the lack of SSL and the domain's recent creation, any residual traffic to this address should be investigated for credential theft or wallet-draining activity. The exact content of the phishing kit remains unanalyzed, but the combination of brand impersonation, wallet-seed phishing classification, and security vendor detections provides sufficient evidence for elevated-risk categorization.