gov-aerodrome[.]org

The domain gov-aerodrome.org was observed hosting a site with the page title “Aerodrome Finance”. The domain was registered on 06 December 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to IP 104.21.53.158, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative name servers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, both Cloudflare‑operated. No TLS certificate was presented, indicating the site was served over plain HTTP or that the certificate was missing at the time of analysis.

Reputation services rate the domain poorly: Gridinsoft assigns a trust score of 0 out of 100, and Google Safe Browsing flags the URL for social‑engineering content. VirusTotal reports that 14 of 95 scanned security vendors flagged the domain, demonstrating a moderate level of detection across independent scanners. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment that it is being used for malicious purposes. The available evidence points to a generic phishing operation that likely attempts to harvest credentials or financial information under the guise of an “Aerodrome Finance” portal.

Because the site is already offline, immediate mitigation focuses on preventing future resolution and credential reuse. Defenders should add the domain and its associated IP address to internal block lists, monitor for any CNAME or DNS changes that point to alternative hosting, and enforce strict email filtering rules for messages that reference “Aerodrome Finance” or similar phrasing. Continuous re‑query of reputation feeds is advised, as the threat actor may register new domains using the same naming pattern. At present, the lack of a TLS certificate, the low trust score, and multiple independent detections constitute sufficient evidence to classify the domain as high‑risk and to treat any related traffic as malicious.