aerodrome-finannce[.]pages[.]dev

This domain, aerodrome-finannce.pages.dev, was identified as a credential phishing site and has been taken offline as of the report date. Infrastructure analysis reveals it was hosted on Cloudflare's network, resolving to IP 172.66.47.129 (AS13335, United States). The domain was registered through Cloudflare, Inc. on February 21, 2026, and utilized Cloudflare nameservers (alexia.ns.cloudflare.com and cash.ns.cloudflare.com). At the time of assessment, the HTTP status returned a 403 Forbidden response, and the page title explicitly stated 'Suspected phishing site | Cloudflare,' aligning with its classification as a social engineering threat by Google Safe Browsing.

Detection data indicates the domain was flagged by 7 of 95 security vendors in VirusTotal scans, though the specific payload or phishing kit remains unconfirmed. It appears on at least one security blocklist and has a Gridinsoft trust score of 0/100, reinforcing its malicious classification. The SSL certificate was issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites leveraging Cloudflare's infrastructure. Technologies detected include HSTS and HTTP/3, which are frequently employed to enhance perceived legitimacy.

While the domain is now offline, defenders should treat any prior connections to this infrastructure as high-risk indicators. The scam type was categorized as credential phishing, though the exact brand or service targeted is not specified in available intelligence. Organizations are advised to review logs for interactions with this domain or its associated IP (172.66.47.129) and monitor for related domains using similar naming conventions or Cloudflare Pages infrastructure. No evidence suggests persistence or lateral movement, but retrospective analysis of network traffic is recommended given the elevated risk level.