erosai[.]app

Analysis of the domain erosai.app shows a newly registered internet property that is actively used for a crypto‑related phishing campaign. The domain was created on February 23, 2026 and is registered through NiceNIC International Group Co., Limited. Infrastructure inspection reveals that the domain resolves to the IPv4 address 166.0.0.0, which is hosted in Germany under ASN 213229 belonging to MITELIS SECURITY LIMITED. The site is served via Cloudflare DNS, using the authoritative name servers fish.ns.cloudflare.com and tate.ns.cloudflare.com.

HTTP requests receive a 307 temporary redirect response, and the site presents no SSL certificate, leaving traffic unencrypted and vulnerable to interception. The page title returned from the server is "ErosAI - AI Neural Network for Adults on Web3," indicating an attempt to lure users with adult‑oriented AI content while promoting cryptocurrency transactions. Threat intelligence scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist, specifically PhishDestroy, which has already flagged it as malicious. VirusTotal analysis shows that three out of ninety‑three scanning engines have identified the domain as malicious, reinforcing the suspicion of a crypto scam.

Despite limited public visibility into the exact payload or credential‑harvesting mechanisms, the combination of a fresh registration, lack of TLS, a redirect response, low trust rating, and multiple vendor detections suggests a high‑confidence malicious operation. Defenders should block erosai.app at network perimeters, monitor DNS queries for the associated Cloudflare name servers, and add the IP 166.0.0.0 to host‑based deny lists. Continuous re‑evaluation of the domain is recommended, as threat actors may evolve the site’s content or infrastructure to evade detection.