eroticax9[.]com

Analysis indicates that the domain eroticax9.com is actively serving a generic phishing campaign. The domain resolves to Cloudflare name servers ines.ns.cloudflare.com and marek.ns.cloudflare.com, suggesting that the attacker is leveraging Cloudflare’s infrastructure to hide the origin of the web server. HTTP requests receive a 301 redirect, which is commonly used to forward victims to a malicious landing page or to obscure the final destination. VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors; none of the vendors raised a detection at the time of the scan. The report explicitly notes that the lack of detections does not constitute confirmation that the domain is benign.

Registration data reveal that the domain was purchased through the registrar Spaceship, Inc., a provider that is frequently used by malicious operators because of its low verification requirements. The domain is currently listed as active and is present on one security blocklist. Additionally, the domain has been added to the PhishDestroy blocklist, indicating that at least one dedicated anti‑phishing service has taken action against it. The available data does not include any observed IP address, geographic location, SSL certificate details, or page title, so the full attack surface cannot be fully mapped at this time.

Defenders should therefore treat the domain as a confirmed phishing infrastructure element. Recommended mitigation steps include adding eroticax9.com to web‑proxy and DNS filtering rules, ensuring that endpoint security solutions are updated to block any URLs associated with the domain, and monitoring network traffic for outbound connections to the Cloudflare name servers listed above. Continuous re‑scanning on VirusTotal or similar platforms is advised to detect any future changes in vendor detections.