aerordome[.]org

The domain aerordome.org was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to IP 172.67.131.33, which resides in the United States and is owned by AS13335 Cloudflare, Inc. The authoritative name servers are hunts.ns.cloudflare.com and mona.ns.cloudflare.com, indicating that the site is fully proxied behind Cloudflare’s edge network. The service advertises HTTP/3 capability and returns an HTTP 302 redirect on initial request. TLS termination is performed with a certificate issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting the brand "across" and presenting a page titled "Aerodrome Finance - Next‑Gen AMM & Liquidity Hub on Base," suggesting a cryptocurrency‑finance lure. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that 2 of 95 security vendors have flagged the domain, reinforcing the suspicion of malicious intent. Additionally, Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of abuse.

While the page title and brand‑target information provide some context, the full content of the site has not been publicly disclosed, leaving the exact phishing workflow and credential‑capture mechanisms uncertain. Defenders should prioritize adding aerordome.org to blocklists at network perimeter and endpoint security layers, monitor DNS queries for the associated Cloudflare IP range, and enforce TLS inspection where feasible. Continuous re‑evaluation of the domain’s status on threat‑intel platforms is advised, as the infrastructure—hosted on a widely used CDN—can be rapidly altered to evade detection.