areodorme[.]fi

This domain, areodorme.fi, is flagged as a brand impersonation threat targeting Aerodrome Finance, a liquidity hub platform. Registered on July 24, 2025, through Realtime Register B.V., the domain resolved to IP 92.113.23.242, hosted on AS47583 (Hostinger International Limited) in Germany. Analysis indicates it was taken offline prior to the report date of July 24, 2026, but residual risk remains due to its recent activity. The domain appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100, reflecting high suspicion.

One of 95 security vendors on VirusTotal flagged the domain, though this single detection does not confirm maliciousness on its own. No SSL certificate was present, and the page title, 'Aerodrome Finance | Liquidity Hub on Network,' directly references the targeted brand, suggesting intent to deceive users into believing the site was legitimate. Nameservers (ns1.dns-parking.com, ns2.dns-parking.com) are associated with low-cost or automated domain parking services, a common trait in phishing infrastructure. Defenders should treat this domain as part of a broader impersonation campaign, particularly if Aerodrome Finance is a relevant asset.

Monitor for re-activation or related domains using the same IP, registrar, or nameserver infrastructure. Blocklist integration is recommended, and historical logs should be reviewed for connections to this domain or its IP. Further investigation into the hosting provider’s network may reveal additional compromised or malicious domains.