aerodrome-finac[.]xyz

The domain aerodrome-finac.xyz has been identified as an active credential harvesting phishing threat. This site employs deceptive tactics to collect sensitive user credentials under false pretenses. No specific brand impersonation has been confirmed, but the nature of the attack targets user login information, increasing the risk of account takeover and identity theft.

aerodrome-finac.xyz is flagged by 8 out of 95 security vendors on VirusTotal for phishing-related behavior. The domain was registered recently on May 06, 2025, through the registrar Sav.com, LLC. It resolves to the IP address 104.21.37.35 and appears on 2 separate security blocklists. Despite being relatively new, it uses an SSL certificate issued by Google Trust Services, which may lend it unwarranted credibility. Additionally, the domain is actively blocked by popular security tools such as MetaMask and SEAL, highlighting its recognized risk in the security community.

Currently, aerodrome-finac.xyz remains an active threat with an elevated risk level. Users are strongly advised to avoid interacting with this domain or submitting any personal information. Organizations should consider adding this domain to internal blocklists and monitor for related phishing attempts. Employing multi-factor authentication and educating users about credential harvesting tactics can mitigate potential damage. Continuous monitoring via reputable security platforms is recommended to track any changes in the domain’s activity or infrastructure.