register-aerodrome[.]app

This domain, register-aerodrome.app, is identified as a crypto drainer phishing site targeting users of the Aerodrome Finance decentralized finance platform. Analysis indicates the domain impersonates legitimate Aerodrome interfaces to trick victims into connecting wallets, enabling unauthorized token transfers via malicious smart contract interactions. No specific drainer kit has been attributed at this time, though the infrastructure aligns with known wallet-draining campaigns observed in prior DeFi phishing operations. Infrastructure analysis reveals the domain was registered on April 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing and fraudulent domains. It resolves to the IP address 188.114.97.3, a host with a history of supporting malicious activity. Detection metrics show 4 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing does not currently list it. The domain appears on one security blocklist, and automated threat intelligence systems have classified it as a generic phishing threat with an elevated risk level. As of the latest assessment, register-aerodrome.app has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. Despite its current inactive status, residual risk remains for users who may have interacted with the domain prior to its removal. Security recommendations include revoking any wallet permissions granted to the domain, monitoring transaction histories for unauthorized activity, and verifying the authenticity of DeFi interfaces through official project channels before connecting wallets.