aerodromev2[.]finance

The domain aerodromev2.finance has been identified as a phishing infrastructure specifically designed to impersonate Aerodrome Protocol, a decentralized finance platform. This domain is classified as a generic phishing threat targeting users through fraudulent interfaces mimicking legitimate crypto services. As of the latest assessment, the domain has been taken offline, but prior activity indicates active credential harvesting and asset diversion attempts. Infrastructure analysis reveals the domain was registered through Name.com, Inc. on April 26, 2026, and resolves to the IP address 104.21.9.3, which is associated with Cloudflare’s content delivery network. Despite its malicious intent, the domain was not flagged by any of the 95 vendors on VirusTotal at the time of analysis. However, it appears on three security blocklists, including MetaMask and PhishDestroy, and holds a Gridinsoft trust score of 0/100. The site employed technologies such as Bootstrap, Unpkg, jsDelivr, AOS, and HTTP/3, alongside a Let’s Encrypt SSL certificate, to create a deceptive appearance of legitimacy. Current status confirms the domain is offline, but the infrastructure remains a potential risk for re-emergence or reuse. Organizations and individuals are advised to block the domain and its associated IP at the network level. Users should verify all crypto-related interactions through official channels and enable multi-factor authentication where possible. Security teams are recommended to monitor for similar domains leveraging Cloudflare IPs or Let’s Encrypt certificates in phishing campaigns, particularly those impersonating decentralized finance protocols.