app-aerodrome-c1[.]top

Analysis indicates that the domain app-aerodrome-c1.top was registered on 18 November 2025 through NiceNIC International Group Co., Limited. The authoritative nameservers george.ns.cloudflare.com and lindsey.ns.cloudflare.com point to Cloudflare's network, and DNS resolution maps the domain to IP 104.21.53.59, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presented the title "Aerodrome Finance", suggesting an attempt to impersonate a financial service, but no SSL certificate was observed, leaving the HTTP connection unencrypted. The domain currently returns an offline status, indicating that the hosting has been taken down or otherwise disabled.

Reputation data shows a Gridinsoft trust score of 0 out of 100, and the domain is listed on four independent blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis recorded detections by 13 of 95 scanning engines, reinforcing the malicious assessment. No additional public intelligence such as OTX or Safe Browsing entries were supplied. The combination of a recent registration, Cloudflare front‑end, lack of TLS, low trust score, multiple blocklist listings, and multiple vendor detections aligns with a high‑risk generic phishing profile.

However, because the site is offline, active payloads cannot be confirmed, and the exact phishing template or credential‑harvesting mechanism remains unknown. Defenders should continue to block traffic to app-aerodrome-c1.top at the network perimeter, update DNS filtering rules, and monitor for any re‑hosting attempts that may use the same domain or similar naming patterns. Incident response teams should also consider correlating any recent authentication failures or credential submissions against the creation date of this domain, as compromised accounts may have been targeted during the brief window when the site was live.