auth-aerodrome-slipstreeam-en-us[.]pages[.]dev

This domain, auth-aerodrome-slipstreeam-en-us.pages.dev, is actively impersonating the Aerodrome brand as part of a high-risk phishing campaign. Registered on October 17, 2025, through Cloudflare, Inc., the domain resolves to IP 172.66.44.115 (AS13335, Cloudflare, Inc., US) and is served via Cloudflare nameservers lloyd.ns.cloudflare.com and sara.ns.cloudflare.com. The page title, 'Aerodrome Slipstream: Understanding Its Effects and Safety Measures,' explicitly references Aerodrome, confirming the brand impersonation intent. The domain is currently active, returning an HTTP 200 status, and employs HSTS and HTTP/3 technologies, which are consistent with modern phishing infrastructure leveraging Cloudflare's services to evade detection. Analysis indicates the domain was flagged by one security blocklist and is blocked by PhishDestroy. Gridinsoft and Scamadviser both assign a trust score of 1/100, reflecting high confidence in its malicious nature. VirusTotal reports that 4 of 93 security vendors detect this domain as malicious, though the specific detection rules or signatures are not disclosed. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing domains to appear legitimate. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for any internal access attempts. The use of Cloudflare hosting and nameservers suggests the threat actor may rapidly rotate infrastructure; thus, defenders should also investigate associated IPs, certificates, and registrar patterns for broader campaign tracking. The exact phishing mechanism (e.g., credential harvesting, malware distribution) remains unconfirmed due to the absence of page content analysis, but the brand impersonation and active status warrant immediate mitigation.