aerodrome[.]finance-portal[.]app

This domain is flagged as a brand impersonation threat targeting users of Aerodrome Finance, a decentralized finance platform. The site aerodrome.finance-portal.app presents itself as an official portal for Aerodrome, likely designed to harvest login credentials, private keys, or seed phrases from unsuspecting users attempting to access DeFi services. The interface mimics legitimate Aerodrome pages, increasing the risk of successful social engineering attacks against cryptocurrency holders. Analysis indicates the domain was registered on November 7, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with newly created phishing infrastructure. It resolves to the IP address 188.114.97.3, which has been linked to other malicious domains in recent months. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The page title 'Nur einen Moment…' suggests the use of a German-language placeholder or anti-bot mechanism, a common tactic in phishing kits to delay or evade automated analysis. Users who visited aerodrome.finance-portal.app should immediately disconnect any connected wallets from the site and revoke any suspicious token approvals using a blockchain explorer or wallet management tool. Change passwords for any accounts accessed while the site was open, and enable multi-factor authentication where available. Monitor wallet activity for unauthorized transactions, and consider transferring funds to a new wallet if any interaction with the site occurred. Report the domain to relevant security teams and blocklists to prevent further exploitation. Security teams should add the domain and its resolving IP to monitoring systems for proactive detection of related threats.