vote-aerodrome[.]live

PhishDestroy identifies vote-aerodrome.live as a confirmed phishing domain hosting a fake voting portal, likely targeting cryptocurrency or token holders by impersonating Aerodrome Finance. This domain masquerades as a legitimate platform to harvest login credentials and sensitive financial data under the guise of governance participation. The threat is active and operational, with no current detections on VirusTotal despite clear malicious intent. The domain vote-aerodrome.live was registered on June 16, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 188.114.97.3 and currently shows 2 out of 95 VirusTotal detections. While not yet blacklisted, this domain remains untrusted with no positive reputation indicators. The recent registration date combined with the spoofed branding (Aerodrome Finance) indicates a likely opportunistic attack targeting crypto communities during periods of high governance activity. This threat type—brand impersonation phishing—employs urgency and false legitimacy to trick users into entering wallet addresses or credentials. Indicators include the domain name (containing 'aerodrome'), suspicious IP reputation (188.114.97.3 associated with multiple low-trust domains), and zero detections on leading scanners. Users must avoid accessing this domain, verify URLs via official sources, enable wallet or platform alerts for unusual transactions, and report suspicious links to their crypto wallet or exchange. Platforms should consider proactive takedown requests given the low VT score and high risk of credential theft.