q3-aerodromefi[.]info

Analysis of q3-aerodromefi.info shows a high‑risk phishing infrastructure that remains active as of the report date, July 19, 2026. The domain resolves to the Cloudflare‑managed address 172.67.128.148, placing the hosting infrastructure in Canada under Cloudflare, Inc. DNS resolution is handled by kobe.ns.cloudflare.com and haley.ns.cloudflare.com, confirming the use of Cloudflare’s authoritative name servers. TLS termination is provided by a Google Trust Services certificate (WE1), indicating a valid, publicly trusted HTTPS endpoint. HTTP requests return a 200 status, suggesting a live web service. The domain is listed on three public blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reflecting consensus among multiple threat‑intelligence feeds. VirusTotal scans have recorded detections from five of ninety‑one security vendors, further corroborating malicious intent. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known to host a mix of legitimate and abusive domains. No page‑level content, brand targeting, or specific phishing kit details are available in the current intelligence, leaving the exact credential‑harvesting method unknown. Defenders should immediately block DNS resolution to q3-aerodromefi.info, add the IP 172.67.128.148 to network denial lists, and monitor for any outbound connections to the domain. Continuous re‑scanning is advised to capture any changes in payload or hosting, and integration of the domain into endpoint protection signatures will help mitigate exposure to the observed phishing campaign.