aerodrome[.]casa

This domain, aerodrome.casa, is currently flagged as a high-risk phishing site targeting cryptocurrency users. Analysis indicates the domain was registered on May 19, 2026, through a major registrar and is hosted on IP address 68.65.123.88, associated with a US-based provider. The domain resolves to a Namecheap parking page, which is a common tactic used to mask malicious intent while awaiting activation of phishing infrastructure. Despite the benign appearance of the parking page, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting prior or ongoing malicious activity. Infrastructure analysis reveals the domain uses nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com, consistent with hosting environments frequently exploited for phishing campaigns. The SSL certificate, issued by Sectigo Limited, is valid but does not mitigate the risk, as phishing sites commonly use legitimate certificates to appear trustworthy. A single security vendor on VirusTotal has flagged the domain, though this limited detection may reflect early-stage targeting or evasion techniques rather than low risk. What remains uncertain is the specific brand or service being impersonated, as the domain name aerodrome.casa does not directly correspond to a known cryptocurrency platform. However, the presence on MetaMask’s blocklist indicates a likely focus on wallet or DeFi credential theft. Defenders should treat this domain as active and high-risk, particularly in environments where cryptocurrency transactions occur. Immediate actions include blocking the domain at the DNS and firewall levels, monitoring for connections to 68.65.123.88, and alerting users to potential phishing attempts referencing this domain. The domain’s recent registration and parking page status suggest it may transition to active phishing use in the near term.