aerotechservicesltd[.]com

Analysis indicates that aerotechservicesltd.com is an active phishing domain targeting entities associated with unmanned aerial vehicle (UAV) services. The domain was registered on October 28, 2025, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently observed in phishing infrastructure. It currently resolves to IP address 163.61.188.9, geolocated to the United States under an autonomous system linked to academic research networks, which may suggest compromised or misconfigured hosting. The site returns an HTTP 200 status and presents a page title of 'AeroTech Services Ltd – Africa’s leading UAV services provider,' implying an attempt to impersonate a legitimate aerospace or drone services organization. Infrastructure review shows the domain is hosted on a Let’s Encrypt SSL certificate (R13) and appears on one security blocklist, with PhishDestroy currently blocking access. AlienVault OTX records the domain in a single threat intelligence pulse, while one of 92 security vendors on VirusTotal flags it as malicious. No additional brand impersonation, phishing kit, or payload delivery has been confirmed at this stage. Defenders should treat this domain as high-risk, particularly for organizations in the aerospace, defense, or logistics sectors. Immediate action includes blocking the domain and IP at network perimeter controls, monitoring for credential submission or file upload activity, and reviewing logs for connections to 163.61.188.9. Further investigation into the hosting provider and certificate transparency logs may reveal related infrastructure or additional compromised assets.