rewards-aerodromefinance[.]com

The domain rewards-aerodromefinance.com is a phishing site engaged in brand impersonation targeting the Aerodrome platform. It presents itself as a rewards or promotional page to deceive users into disclosing login credentials or sensitive information, constituting a direct threat of credential theft. No crypto drainer kit was identified in this campaign. The site is currently taken offline, but prior activity poses residual risk to users who may have interacted with it.

Technical indicators confirm the malicious nature of rewards-aerodromefinance.com. The domain was flagged by 1 of 95 VirusTotal security vendors, including Gridinsoft, which assigned a trust score of 0/100. It appears on 2 security blocklists, specifically PhishDestroy and ScamSniffer, though Google Safe Browsing did not flag it. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on September 01, 2025, the domain resolves to the IP address 104.21.96.1, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate is issued by WE1, and the observed page title was 'Just a moment...'.

Users who visited rewards-aerodromefinance.com should immediately change any passwords or credentials entered on the site, particularly for Aerodrome or related financial accounts. Enable two-factor authentication (2FA) on all sensitive platforms to mitigate further risk. Monitor accounts for unauthorized transactions or suspicious activity. Report the domain to relevant authorities or security teams, such as the impersonated brand (Aerodrome) or platforms like PhishTank or the Anti-Phishing Working Group (APWG), to aid in broader mitigation efforts.