votes-aerodromefinance[.]xyz

This domain is actively facilitating cryptocurrency draining attacks, a specific form of phishing designed to exploit wallet connections and siphon digital assets. Analysis indicates the site employs deceptive interfaces mimicking legitimate decentralized finance platforms, tricking users into authorizing malicious transactions that transfer funds to attacker-controlled addresses. The threat primarily targets users through social engineering tactics, including fake airdrop promotions or governance proposal pages, which are common vectors for crypto drainer schemes. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on March 14, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with fraudulent activity. It resolves to the IP address 172.67.149.248 and is currently flagged by 11 out of 95 security vendors on VirusTotal, including multiple blockchain security and anti-phishing engines. Additionally, the domain appears on three independent security blocklists and is actively blocked by several wallet protection mechanisms. The site employs Cloudflare services, including Browser Insights and HTTP/3, which are often leveraged to obfuscate malicious infrastructure and evade detection. Users who have interacted with votes-aerodromefinance.xyz should immediately revoke any connected wallet permissions and cease all interactions with the domain. It is critical to review recent transactions for unauthorized transfers and monitor connected accounts for signs of compromise. If funds were transferred, report the incident to relevant blockchain analytics platforms and local cybercrime authorities. Proactive measures include updating wallet software, enabling transaction simulation tools, and verifying domain authenticity through official project channels before connecting wallets. The future-dated registration suggests potential long-term malicious intent, warranting continued vigilance.