proposals-aerodromefi[.]net

On 24 July 2026, the domain proposals-aerodromefi.net was observed being used for brand impersonation targeting the Aerodrome brand. The domain was registered on 21 February 2026 and is hosted behind Cloudflare (AS13335) with the IP address 172.67.186.214 located in the United States. The SSL certificate presented is identified as WE1, indicating a standard Cloudflare‑issued certificate without further validation. The page title returned by the server is "Aerodrome Proposal", matching the declared brand target. Automated analysis by multiple security services has produced consistent findings: PhishDestroy and ScamSniffer have both added the domain to their blocklists, and the domain appears on two additional security blocklists.

AlienVault OTX reports the domain in a single threat‑intelligence pulse, confirming its inclusion in external intelligence feeds. On VirusTotal, 14 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. Gridinsoft’s trust score rates the host at 0 out of 100, indicating a classification of extremely low reputation. The site is currently taken offline, which limits immediate exposure but does not remove the historical risk associated with the domain’s previous activity. Analysis indicates that the infrastructure choices—use of a well‑known CDN provider, a generic SSL certificate, and a low‑reputation trust score—are consistent with typical brand‑impersonation campaigns that rely on rapid deployment and quick takedown to evade detection.

The presence on multiple blocklists and the VirusTotal detection rate provide concrete evidence that the domain has been actively used for malicious purposes. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been hosted, as no page content beyond the title has been disclosed. Defenders should continue to block proposals-aerodromefi.