join-aerodrome[.]xyz

join-aerodrome.xyz was observed by multiple threat‑intelligence feeds in early 2026. The domain is registered through Dynadot LLC, with creation date 23 February 2026. DNS resolution points to 172.67.132.44, an address owned by AS13335 Cloudflare, Inc., confirming that the site leveraged Cloudflare’s edge network and HTTP/3 support. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid public‑trusted certificate chain.

HTTP probing returned a 404 status and the page title displayed “join-aerodrome.xyz | 504: Gateway time‑out”, suggesting the service is no longer responding. The domain is currently listed on four reputable blocklists – PhishDestroy, MetaMask, ScamSniffer and SEAL – and two of ninety‑three VirusTotal scanners flagged it as malicious, reinforcing the suspicion of abusive use. No additional content analysis is available because the site is offline, so the exact phishing payload or lure cannot be confirmed. Defenders should continue to block the domain at perimeter defenses, update URL filtering rules to include the four blocklist identifiers, and monitor for any future resolution changes that might indicate re‑use of the same IP space.

Because the domain uses a legitimate Cloudflare front‑end and a trusted SSL certificate, static certificate pinning is ineffective; reputation‑based controls remain the primary mitigation. Continuous observation of the registrar Dynadot LLC and the associated nameservers (sima.ns.cloudflare.com, tate.ns.cloudflare.com) is recommended to detect possible re‑registration attempts. In summary, the available evidence points to a confirmed phishing‑related infrastructure that is presently offline but should be treated as hostile until proven otherwise.