aerodrome-check[.]xyz

The domain aerodrome-check.xyz was registered on April 17, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently resolving to the Cloudflare‑owned address 188.114.96.3, which is geolocated to Canada. DNS resolution is handled by roan.ns.cloudflare.com and roxy.ns.cloudflare.com. The site presents a valid Let's Encrypt certificate (E8) but returns an HTTP 403 response to direct requests, a pattern often seen in credential‑harvesting pages that block automated crawlers while serving content to targeted browsers. The domain has been flagged by PhishDestroy and appears on one public blocklist, indicating that at least one anti‑phishing feed has already taken action against it.

Threat intelligence sources corroborate the malicious intent. The domain is listed in a single AlienVault OTX pulse, and VirusTotal records five out of ninety‑five scanners flagging the domain as malicious, reinforcing the high‑risk classification. Gridinsoft assigns a trust score of 0 out of 100, and the overall risk level is marked as high. These data points collectively confirm the presence of a generic phishing campaign operating from this infrastructure, despite the limited number of security vendor detections at this time.

Defenders should prioritize blocking DNS resolution to aerodrome-check.xyz and any traffic to its resolving IP address 188.114.96.3. Monitoring for TLS connections using the Let's Encrypt/E8 certificate can help identify compromised clients that may have already interacted with the site. Given the active status, continuous re‑evaluation of blocklist entries and periodic re‑scans with updated security tools are advised to capture any escalation in the detection rate. Organizations should also educate end users about suspicious emails that may reference the aerodrome‑check.xyz domain, as the phishing payload is likely delivered through credential‑stealing pages disguised as legitimate services.