aerodromefi-votes[.]xyz

PhishDestroy identifies aerodromefi-votes.xyz as a suspected crypto drainer phishing domain, designed to trick users into connecting wallets and stealing cryptocurrency assets. The domain mimics legitimate crypto-related platforms by using deceptive naming conventions (aerodromefi-votes), which may lure victims into authorizing fraudulent transactions. Once connected, malicious smart contracts can drain wallets of tokens without user confirmation, making this a high-risk threat to cryptocurrency holders. This domain was flagged by PhishDestroy’s automated monitoring system with seed identifier 166b1b. It resolves to IP address 104.21.32.158 and currently shows 0 detections out of 95 on VirusTotal, indicating it has not yet been widely blacklisted. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 25, 2026, the domain remains active despite its recent creation. Security researchers note that such newly registered domains are frequently weaponized in short-lived campaigns to evade detection. Users who visited aerodromefi-votes.xyz should immediately disconnect any connected wallets, revoke any unauthorized token approvals using tools like revoke.cash or Etherscan, and scan their devices for malware. Do not interact with any prompts or transactions on this domain. If funds were stolen, report the incident to local law enforcement and file a complaint with the FBI IC3 or relevant cybercrime unit. For ongoing protection, verify all domains before entering sensitive information using PhishDestroy’s real-time threat database.