aerodroma[.]finance

PhishDestroy confirms aerodroma.finance is an active, high-risk generic phishing site posing as Aerodrome Finance to steal cryptocurrency assets. The page title, visual assets, and branding closely replicate the legitimate Aerodrome Finance platform. No evidence of a custom drainer kit was observed; the threat relies on social engineering and domain spoofing to trick users into connecting wallets and approving fraudulent transactions.
This domain was registered on May 01, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP 188.114.96.3. The SSL certificate is issued by Let's Encrypt, providing false legitimacy. 8 out of 95 VirusTotal security vendors flag the domain as malicious. Google Safe Browsing (GSB) status remains unconfirmed, though third-party blocklists already include this domain across multiple feeds.
As of current analysis, aerodroma.finance remains active and unresolved. Immediate blocking at DNS and browser levels is strongly advised. Users are urged to verify URLs via official channels and never interact with unsolicited links. The combination of newly registered domain, low detection score, and active resolution indicates a rapidly evolving threat with high potential for financial harm. Remaining risk is assessed as high until takedown or full deactivation occurs.