aerodrome[.]city

The domain aerodrome.city was observed targeting Binance users through a wallet/seed phishing campaign. The site presented the page title “TraceGuard - AML Crypto”, suggesting an attempt to associate the page with anti‑money‑laundering services. VirusTotal reports indicate that seven of ninety‑three scanning engines flagged the domain as malicious, reflecting a moderate detection consensus. The domain is listed on two public blocklists and has been explicitly blocked by PhishDestroy and ScamSniffer, confirming its inclusion in known phishing feeds.

Reputation services assign extremely low scores, with Scamadviser reporting a trust rating of 1 / 100 and Gridinsoft a rating of 0 / 100, underscoring the lack of legitimacy. Infrastructure analysis shows the domain resolves to IP 47.251.125.76, which belongs to the Alibaba Cloud network (AS45102) and is physically located in the United States. The domain is serviced by GoDaddy’s DNS infrastructure (ns11.domaincontrol.com, ns12.domaincontrol.com) and presents a GoDaddy‑issued TLS certificate (GoDaddy TLS Intermediate CA DV – R1v1). An AlienVault OTX pulse references the domain once, further indicating prior detection.

The site is currently offline, limiting immediate observation, and no additional page content has been captured beyond the title. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same IP or certificate, and add the associated IP and nameserver pair to threat‑intel feeds. Given the low reputation scores and existing blocklist entries, the domain should be treated as high‑confidence phishing infrastructure targeting Binance users.