votes-aerodrome[.]xyz

Analysis indicates that votes-aerodrome.xyz was registered on February 24, 2026 through NiceNIC International Group Co., Limited and resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain was configured to use Cloudflare’s authoritative nameservers dina.ns.cloudflare.com and ricardo.ns.cloudflare.com. No SSL certificate was observed for the host, meaning the site did not provide HTTPS encryption when it was online. The only visible attribute on the landing page was the title "Aerodrome Finance," suggesting an attempt to convey a financial‑related service, but no further content details are available.

Security telemetry shows that the domain was flagged by multiple protection services: it appears on three independent security blocklists and is explicitly listed by PhishDestroy, MetaMask, and SEAL as a malicious resource. VirusTotal scans reported that two of ninety‑three vendor engines identified the domain as malicious, reinforcing the blocklist findings. The site was taken offline prior to this assessment, and its current HTTP status is therefore unavailable.

Defenders should continue to block traffic to votes-aerodrome.xyz at network perimeters and update endpoint and browser security policies to include the known blocklist identifiers. Because the domain leveraged Cloudflare’s infrastructure, any future re‑hosting under the same IP range could inherit a reputation of abuse; therefore, monitoring of the associated IP (188.114.96.3) for new malicious activity is advisable. Incident response teams should also consider the domain’s recent registration date as a potential indicator of rapid‑deployment phishing campaigns and treat similar newly‑registered domains with heightened scrutiny until further evidence emerges.