app-aero[.]xyz

PhishDestroy assesses app-aero.xyz as an ACTIVE cryptocurrency phishing domain engaged in generic credential theft attempts. The site masquerades as a legitimate application, luring users into surrendering sensitive wallet credentials under the guise of routine authentication or software updates. This domain was flagged by PhishDestroy after it appeared on 2 security blocklists and was independently blocked by MetaMask and SEAL. VirusTotal currently shows 0 detections out of 95 engines. The domain resolves to IP 104.21.77.60 and uses a Google Trust Services SSL certificate. It was registered on March 11, 2025 through Sav.com, LLC, indicating a very recent and likely opportunistic campaign. Given the domain’s recent registration, low detection rate, and active blocking by major security platforms, users should treat app-aero.xyz as hostile and avoid interaction entirely. If accidentally accessed, users should immediately disconnect from the site, clear browser cache and cookies, and inspect wallet extensions for unauthorized permissions. Report the domain to your security team and consider revoking any exposed credentials or tokens. Organizations are advised to block the domain at DNS and firewall levels and update browser policies to include the IP and certificate issuer as indicators of compromise.