aerodrome[.]cards

Analysis of the domain aerodrome.cards indicates that it is currently offline but was previously serving content titled “Staking | Aerodrome finance”. The site was registered on December 11, 2025 through Dynadot LLC and uses the Cloudflare nameservers celine.ns.cloudflare.com and lex.ns.cloudflare.com. DNS resolution points to the IP address 104.21.13.105, which belongs to AS13335 Cloudflare, Inc., a common hosting provider for malicious infrastructure. No TLS certificate is presented for the host, suggesting that HTTPS was not configured at the time of observation.

The page title references “Aerodrome finance”, yet the domain is listed as a brand‑impersonation campaign targeting the cryptocurrency aggregator 1inch. VirusTotal scans show that two of ninety‑three security vendors flagged the domain as malicious, and five independent blocklists have already listed it. Additional blocking services—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—report the domain as prohibited.

The combination of a recent registration date, use of a reputable CDN without encryption, minimal but consistent detection across multiple vendors, and explicit targeting of the 1inch brand constitute a credible elevated‑risk indicator. Defenders should add aerodrome.cards to DNS‑level deny lists, monitor traffic to the associated Cloudflare IP for any resurgence, and enforce application‑layer filters that block requests containing the “Staking | Aerodrome finance” title or references to 1inch. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in the domain’s hosting or content.