aerodrome[.]co[.]com

The domain aerodrome.co.com was registered on May 27, 2026 through Moniker Online Services LLC. Within weeks of creation it began serving HTTP responses with a 200 status code, indicating an active web presence. The domain is currently listed as active and has been classified as a high‑risk generic phishing site. Infrastructure analysis shows the domain resolves to the IP address 68.65.123.154, which is hosted by Namecheap, Inc in the United States. The authoritative name servers are ns1.nic.co.com through ns4.nic.co.com, all pointing to the same hosting environment. The site presents a Sectigo Limited / Sectoro Public Server Authentication CA DV R36 certificate, confirming the use of a publicly trusted TLS certificate. Threat intelligence indicates the domain appears on three security blocklists and has been blocked by multiple threat‑mitigation tools, including PhishDestroy, MetaMask, and SEAL. VirusTotal scans have resulted in two of ninety‑five security vendors flagging the domain, reinforcing the suspicion of malicious activity despite a relatively low detection ratio. While the exact phishing payload has not been publicly disclosed, the combination of a newly created domain, a valid TLS certificate, a responsive web server, and inclusion on multiple blocklists aligns with typical infrastructure employed by phishing operators. The lack of additional public artifacts leaves the specific lure or targeted brand ambiguous, but the high‑risk rating reflects the confidence in the generic phishing classification. Defenders should prioritize immediate containment by adding aerodrome.co.com and its resolving IP 68.65.123.154 to network‑level deny lists and email filtering rules. Continuous monitoring of the name servers and certificate renewal events is advised to detect potential re‑use. Where possible, sinkholing the IP or redirecting traffic to a safe landing page can mitigate user exposure while further forensic investigation proceeds.