ercuni[.]com

ercuni.com was registered on February 21 2026 through NameCheap, Inc. The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States and is served behind Cloudflare’s edge network using HTTP/3. The site presents a page title of "usdt", indicating an attempt to lure victims interested in the USDT stablecoin. Technical fingerprinting shows the front‑end is built with Vue.js and loads resources from unpkg, while the TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS connection. HTTP response code 302 is observed, suggesting the site redirects visitors, a common technique in phishing deployments.

The domain has a Gridinsoft trust score of 0/100 and is listed on one external blocklist. PhishDestroy has already blocked the site, and two of ninety‑three VirusTotal scanners have flagged it as malicious. The page is currently active and continues to resolve. Defenders should add ercuni.com to URL filtering rules, block its IP 188.114.97.3 at the perimeter, and enforce TLS inspection to capture the redirect payload.

Monitoring Cloudflare name servers hugh.ns.cloudflare.com and ophelia.ns.cloudflare.com for any additional domains tied to the same infrastructure is advised. Because the site’s content beyond the title has not been publicly analysed, further sandboxing of the landing page is recommended to identify any credential‑stealing forms or malicious scripts. Continuous re‑evaluation of detection vendor scores and blocklist status is necessary, as additional indicators may appear as the campaign evolves.