bittensor-ai[.]us

bittensor-ai.us was registered on 21 February 2026 and currently resolves to the Amazon Web Services IP address 216.150.1.1 (AS16509, United States). The domain is listed on a security blocklist and is actively blocked by PhishDestroy, indicating that threat‑intelligence feeds have identified it as malicious. The site presents the page title “Bittensor” and is associated with a crypto‑scam classification. Analysis of public scanning services shows that 7 of 93 security vendors on VirusTotal have flagged the host as malicious, reinforcing the suspicion of abusive activity.

The SSL certificate is identified as R13, which is a low‑trust certificate commonly observed on fraudulent infrastructure. The domain is explicitly reported to impersonate the MetaMask brand, a well‑known cryptocurrency wallet, and the overall scam type is recorded as a crypto scam. The site is presently offline, which limits real‑time observation, but the infrastructure footprint—AWS hosting, low‑trust certificate, and blocklist presence—remains indicative of a threat actor that leverages rented cloud resources for short‑lived phishing or credential‑stealing campaigns.

Defenders should add the IP address 216.150.1.1 to network‑level deny lists, monitor for any DNS queries to bittensor‑ai.us, and ensure that endpoint protection solutions are updated to reflect the 7 vendor detections reported by VirusTotal. Email gateways and web proxies should be configured to block traffic to this domain and to any subdomains that resolve to the same IP range. Continuous intelligence gathering is recommended to detect any re‑registration attempts or the emergence of similar domains that target the MetaMask brand.