aerodrome[.]cafe

This domain, aerodrome.cafe, is flagged as a brand impersonation threat targeting users of the decentralized exchange 1inch. The site presents itself as an official Aerodrome Finance staking portal, using the page title 'Staking | Aerodrome finance' to deceive visitors into connecting cryptocurrency wallets. Analysis indicates the site functions as a crypto drainer, designed to siphon funds by tricking users into approving malicious transactions under the guise of legitimate staking opportunities. The risk level is elevated due to the direct financial impact and the sophistication of the impersonation tactics employed. Infrastructure analysis reveals the domain was registered on December 11, 2025, through Dynadot LLC, a registrar frequently associated with malicious domains. The domain resolves to the IP address 104.21.36.168 and is currently offline, though this status may change. Detection metrics show 12 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on at least one security blocklist. The Gridinsoft trust score of 0/100 further corroborates the domain's high-risk classification. These indicators collectively demonstrate a coordinated effort to exploit users through brand impersonation and fraudulent financial services. Users who visited aerodrome.cafe or interacted with its content should take immediate action to mitigate potential losses. First, revoke any wallet approvals granted to the domain or associated smart contracts using a blockchain explorer or wallet management tool. Next, transfer assets to a new wallet address and monitor all connected accounts for unauthorized transactions. If credentials were entered, reset passwords for all associated accounts and enable multi-factor authentication where available. Report the incident to relevant blockchain security teams and consider filing a complaint with the domain registrar, Dynadot LLC, to aid in further investigation and takedown efforts.