aero-treasury[.]info

Analysis as of August 03, 2026 indicates that the domain aero-treasury.info is actively being used in a generic phishing campaign. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that it has been identified as malicious by at least one reputable sink‑hole. VirusTotal records show that the domain was submitted for scanning and examined by 91 independent antivirus and URL‑reputation engines; none of those engines raised a detection at the time of the scan. The absence of detections does not imply safety, as many phishing sites evade automated signatures and rely on fast‑flux or content changes that occur after the scan.

No additional data such as registrar information, IP address, autonomous system number, hosting provider, SSL certificate details, HTTP response codes, Safe Browsing status, Open Threat Exchange (OTX) reports, or page title have been disclosed. Consequently, the infrastructure surrounding the domain cannot be fully profiled, and its geographic or network origin remains uncertain. Defenders should treat aero-treasury.info as a high‑confidence indicator of compromise. Immediate actions include adding the domain to web‑filter block lists, updating intrusion‑detection signatures, and ensuring that email gateways enforce URL reputation checks that incorporate the blocklist entry from PhishDestroy.

Continuous monitoring of the domain’s DNS resolution and any future VirusTotal or sandbox submissions is recommended, as changes in hosting or content could trigger detections later. Organizations should also review recent logs for outbound connections to this domain and consider isolating any internal hosts that have contacted it. Because the domain’s hosting details are unknown, threat‑intel teams may query passive DNS services and WHOIS records to enrich the profile and potentially attribute the infrastructure to a broader campaign.