# aerodrome-finance-coai-swap.pages.dev — MALICIOUS

> Aerodrome-finance-coai-swap.pages.dev is a crypto drainer phishing site flagged by 8/95 VirusTotal vendors. Avoid this fraudulent swap platform immediately.

## Summary
PhishDestroy identifies an active crypto drainer campaign targeting users via the fraudulent domain aerodrome-finance-coai-swap.pages.dev. This page impersonates Aerodrome Finance, a legitimate decentralized exchange, to trick victims into connecting cryptocurrency wallets and authorizing malicious token approvals. Once connected, the drainer silently transfers assets to attacker-controlled wallets without user consent. This campaign exploits user trust in well-known DeFi platforms and leverages Cloudflare Pages for rapid deployment and evasion of takedown efforts.  This domain was flagged by 8 out of 95 security vendors on VirusTotal, indicating elevated risk and widespread detection across multiple threat intelligence platforms. Registered through Cloudflare, Inc., the domain resolves to IP address 188.114.96.3 and holds a valid SSL certificate from Google Trust Services, increasing its credibility and likelihood of deceiving users. The combination of legitimate infrastructure, high VirusTotal detection rate, and impersonation of a major DeFi brand makes this a particularly dangerous threat to cryptocurrency users.  If you visited aerodrome-finance-coai-swap.pages.dev or entered any credentials or wallet connections, immediately revoke all token approvals using tools like revoke.cash or your wallet’s built-in approval manager. Disconnect the site from your wallet immediately. Scan your device for malware using reputable antivirus software and consider transferring remaining assets to a new, secure wallet. Report the domain to your wallet provider and relevant authorities such as the FBI IC3 or local cybercrime units. Never reuse passwords or wallet seed phrases across platforms.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 8 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/371b7b2d-6795-4ae0-a78a-3e48032c272b
- PhishDestroy: https://phishdestroy.io/domain/aerodrome-finance-coai-swap.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/aerodrome-finance-coai-swap.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/aerodrome-finance-coai-swap.pages.dev/
Last updated: 2026-03-23