aerco[.]ltd

This domain, aerco.ltd, is identified as a phishing site designed to impersonate financial service login portals. Analysis indicates the absence of a specific brand name in available data, though the infrastructure suggests credential harvesting rather than cryptocurrency draining or direct financial fraud. The site employs common frontend libraries such as particles.js, Bootstrap, jQuery, and Modernizr, alongside HTTP/3 and LiteSpeed server technologies, which are consistent with modern phishing frameworks. No known drainer kit signatures were detected in preliminary scans, but the use of Smartsupp suggests live interaction or monitoring by threat actors. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Dynadot LLC, a registrar frequently observed in phishing campaigns. It resolves to the IP address 198.251.89.220, which has been flagged by security vendors. VirusTotal reports 5 out of 95 security vendors detecting the domain as malicious, while two blocklists—PhishDestroy and OISD—have actively blocked it. The domain currently holds a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk. No entries were found in Google Safe Browsing at the time of analysis, though this does not preclude prior or intermittent listings. The domain has since been taken offline, likely in response to detection by security vendors and blocklist providers. Despite its inactive status, residual risk remains due to the potential reuse of associated infrastructure, such as the IP address or registrar. Organizations are advised to monitor for related domains registered under the same registrar or resolving to the same IP range. End users should be cautioned against entering credentials on any site linked to aerco.ltd, even if the page appears non-functional. Network-level blocking of the IP 198.251.89.220 is recommended as a proactive measure against potential resurgence.