new-finance-aerodrome[.]pages[.]dev

PhishDestroy identifies new-finance-aerodrome.pages.dev as an active credential theft phishing site impersonating financial services to harvest login credentials. The domain is currently live and operational, distributing malicious content under the guise of a legitimate finance portal. The domain new-finance-aerodrome.pages.dev presents the following verified indicators. VirusTotal analysis shows 1 of 95 security vendors flagged this domain as malicious. The domain is registered through Cloudflare, Inc. and resolves to IP address 172.66.44.75. The SSL certificate is issued by Google Trust Services, increasing the appearance of legitimacy. Despite these superficial trust signals, the domain remains flagged by multiple threat intelligence systems and continues to operate in an elevated-risk state. This domain is confirmed active and poses a direct threat to users who may input sensitive information under false pretenses. PhishDestroy recommends immediate network-level blocking of new-finance-aerodrome.pages.dev and the associated IP 172.66.44.75. Users who have visited this site should assume potential credential compromise and reset passwords used on the domain. Organizations are advised to deploy browser-based URL filtering to prevent access and to monitor internal DNS logs for resolution attempts to this malicious domain. Due to the use of Cloudflare infrastructure, traditional IP-based blocking may be insufficient; domain-level blocking is strongly preferred. The domain should be treated as a confirmed threat and reported to relevant threat intelligence platforms.