aerofromefi-vote[.]xyz

This domain, aerofromefi-vote.xyz, is identified as a crypto drainer phishing site designed to harvest wallet credentials through fraudulent voting or governance scams. Analysis indicates the domain is currently offline, though prior activity suggests it impersonated decentralized finance (DeFi) platforms to deceive users into connecting wallets under false pretenses. Infrastructure analysis reveals the domain was registered on May 24, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.208.161 and is flagged by 12 of 95 security vendors on VirusTotal. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. Its SSL certificate, issued by Let's Encrypt (serial number E7), provides minimal assurance, as it is commonly exploited for short-lived phishing campaigns. The domain's current offline status does not eliminate the risk, as threat actors often rotate infrastructure. Organizations and users are advised to block the domain and its associated IP at the network level. Wallet providers should monitor for transaction requests originating from this domain or its IP. End users should verify governance participation links through official project channels and enable multi-factor authentication for wallet access. Historical WHOIS data and passive DNS records should be preserved for forensic analysis if prior exposure is suspected.