aerodromeauthorization[.]com

The domain aerodromeauthorization.com is currently active and classified as a high‑risk brand‑impersonation operation targeting the Aerodrome brand. The site presents a page titled “SECURITY CHECK”, which is commonly used in credential‑harvesting flows. The domain was registered on August 17 2025 through Ultahost, Inc., within the typical lifecycle of malicious infrastructure.

Infrastructure analysis shows the domain resolves to IP address 82.25.35.148, which belongs to AS21859 operated by Zenlayer Inc. The IP geolocates to the United Kingdom. DNS resolution is served by Cloudflare nameservers addilyn.ns.cloudflare.com and rudy.ns.cloudflare.com, suggesting the attackers are leveraging Cloudflare’s CDN to hide origin infrastructure. No TLS certificate is associated with the domain, and the HTTP response is a 302 redirect, indicating active redirection behavior.

Reputation services flag the domain as malicious: Scamadviser assigns a trust score of 26 / 100, Gridinsoft reports 0 / 100, and the domain appears on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal indicates that 1 of 95 security vendors has flagged the domain, providing limited but corroborating evidence. The combination of a brand‑impersonation label, lack of encryption, and redirection behavior aligns with typical credential‑stealing campaigns.

Defenders should treat aerodromeauthorization.com as hostile. Immediate actions include adding the domain and its resolving IP to block lists, configuring DNS sinks or firewall rules to prevent connection attempts, and monitoring for similar registration patterns. Because the exact content beyond the page title has not been publicly disclosed, analysts should continue to sample the site for potential payloads or credential collection mechanisms. Ongoing observation of the associated Cloudflare nameservers may reveal additional malicious domains that share the same infrastructure.