aerodrrome[.]xyz

This domain, aerodrrome.xyz, is flagged as an active brand impersonation threat targeting Google. Registered on April 14, 2026, through Dynadot LLC, the domain currently resolves to IP 188.114.97.3, hosted on Cloudflare infrastructure in Canada. Analysis indicates the use of Cloudflare nameservers (eleanor.ns.cloudflare.com and jakub.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which may attempt to lend legitimacy to the operation. The domain appears on one security blocklist and is included in a threat intelligence pulse on AlienVault OTX, suggesting prior detection by security communities. The HTTP response code is 403 (Forbidden), and the page title reads 'Just a moment...', a common Cloudflare interstitial that may obscure the actual malicious content. While three of 94 security vendors on VirusTotal flag the domain, the exact nature of the phishing kit or payload remains unconfirmed due to the lack of direct access or deeper forensic analysis. The domain's creation date aligns with recent phishing campaigns, and its continued activity as of July 12, 2026, indicates an ongoing threat. Defenders should treat this domain as high-risk and prioritize blocking it at DNS, proxy, or endpoint levels. Monitoring for connections to 188.114.97.3 or related Cloudflare IPs may help identify compromised systems. Further investigation into associated certificates (Google Trust Services WE1) and registration patterns (Dynadot LLC) could reveal additional linked infrastructure. Given the domain's active status and brand impersonation focus, organizations should alert users to potential credential theft or malware distribution risks.