aerodromefi[.]news

On 2026-08-02 the domain aerodromefi.news was observed actively used in a phishing campaign. VirusTotal records show that two out of ninety-one scanned security vendors have generated detections for the domain, indicating that at least a subset of analysis engines consider the host malicious. The domain is currently listed on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, reinforcing its classification as a phishing-related resource. The risk rating assigned by the reporting entity is elevated and the operational status is active, suggesting ongoing exploitation.

Publicly available metadata such as registrar information, registration date, IP address, hosting provider, SSL certificate details, HTTP response codes, or page title have not been disclosed in the current intelligence feed, leaving those infrastructure components unverified. Consequently, the full scope of the hosting environment and potential affiliate infrastructure remains unknown. Defenders should immediately add aerodromefi.news to deny-list rules across web proxies, DNS filters, and endpoint protection solutions.

Monitoring of outbound connections to the domain, as well as inspection of any inbound traffic that may be redirected to it, is advised. Given the existing blocklist coverage, organizations that have not yet integrated PhishDestroy, MetaMask, or SEAL should consider doing so to benefit from their existing detections. Continuous re-evaluation of the domain’s status is recommended, as additional detections or host changes may emerge.