aerodrome--slipstream[.]pages[.]dev

This domain is actively impersonating Across Protocol, a legitimate decentralized finance platform, under the guise of a trading service named Aerodrome Slipstream. The site is designed to deceive users into connecting wallets or entering sensitive credentials, likely to drain funds or harvest private keys. The fraudulent nature is reinforced by the use of a misleading page title and branding elements that closely mimic the official Across Protocol interface, increasing the risk of successful social engineering attacks targeting cryptocurrency users.

Analysis indicates the domain was registered on August 23, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.46.243, associated with Cloudflare’s infrastructure in the United States. Security vendor assessments on VirusTotal show 1 out of 95 engines flagging the domain as malicious, while it also appears on one security blocklist. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as fraudulent sites commonly leverage valid certificates to appear legitimate. The combination of recent registration, brand impersonation, and minimal detection by security tools suggests a targeted campaign with low initial visibility.

If you visited aerodrome--slipstream.pages.dev or interacted with its content, immediately disconnect any connected wallets and revoke permissions via your wallet provider’s interface. Scan your device for malware using updated security software, and monitor connected accounts for unauthorized transactions. Report the domain to your wallet provider and relevant security teams to aid in takedown efforts. Avoid re-engaging with the site, and verify all future interactions with Across Protocol exclusively through its official channels to prevent further exposure.