dev-aerodrome[.]finance

This domain, dev-aerodrome.finance, is flagged for brand impersonation targeting Aerodrome Finance, a decentralized finance protocol. Analysis indicates the site mimics a legitimate development or staging portal, likely designed to deceive users into submitting sensitive credentials, such as wallet private keys, API tokens, or platform login details. The domain employs social engineering tactics by presenting itself as an official or affiliated development environment, exploiting trust in the Aerodrome brand to facilitate fraudulent activities. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. As of the latest scan, the domain has 0/95 detections on VirusTotal, indicating no antivirus engines currently flag it as malicious. However, it appears on 1 security blocklist, suggesting emerging recognition of its threat potential. The domain resolves to the IP address 188.114.97.3 and is protected by Cloudflare, which provides SSL encryption via a Google Trust Services certificate. Additional technical indicators include the use of HTTP/3 and HTTP Strict Transport Security (HSTS), which may be leveraged to appear more legitimate to end users. Users who have interacted with dev-aerodrome.finance should assume potential compromise of any submitted credentials or sensitive information. Immediate actions include revoking access to any connected wallets, rotating API keys, and monitoring accounts for unauthorized transactions. If financial assets were linked, users should transfer funds to a new, secure wallet and report the incident to relevant platform support teams. Network-level blocking of the domain and its associated IP (188.114.97.3) is recommended for organizations to prevent further exposure. Given the domain’s recent registration and low detection rates, continued vigilance and proactive threat intelligence monitoring are advised.