dot[.]aerodrome[.]baby

The domain dot.aerodrome.baby is currently offline but exhibits multiple indicators consistent with a brand‑impersonation crypto scam targeting the 1inch platform. Registration data shows the domain was created on 5 November 2025 through Dynadot LLC, and it is served by Cloudflare’s DNS infrastructure (celine.ns.cloudflare.com, lex.ns.cloudflare.com). DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States.

No TLS certificate is presented for the host, confirming the absence of HTTPS protection. The sole page title retrieved before takedown reads “Staking | Aerodrome finance,” suggesting a lure toward cryptocurrency staking services, a pattern commonly used in fraudulent schemes that mimic legitimate DeFi projects. VirusTotal has logged three detections out of ninety‑three scanning engines, and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer, reinforcing the malicious classification.

While the site’s full content has not been captured, the combination of brand impersonation, the crypto‑focused page title, and the blocklist presence provides sufficient evidence for a heightened risk rating. Defenders should immediately add dot.aerodrome.baby to network and endpoint blocklists, monitor traffic to its Cloudflare IP for any resurgence, and apply URL filtering for any references to 1inch‑related phishing. Continuous observation of newly registered domains using the same registrar or similar naming patterns is also advised to pre‑empt future impersonation attempts.