Is aerodromes.news a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain aerodromes.news presents itself under a news-oriented top-level domain, but its homepage could not be viewed as intended. The edge security layer in front of the site returned a "Suspected Phishing" warning interstitial in place of any publisher content, so no articles, branding, operator details or commercial offer were observed. The site's apparent purpose therefore cannot be established from its own content, and the only thing a visitor is shown is a security block page.

Scam/Impersonation Risk

This site carries an elevated risk and should be handled cautiously. Several major security vendors independently flag the domain as malicious, with one more rating it suspicious. This places it on a confirmed blacklist and triggers the strongest reputational override in the assessment. The warning interstitial on the homepage is consistent with those detections. The domain is also very recently registered, which is typical of disposable infrastructure. The detections are unspecific about the exact malicious behaviour, so the type of abuse (phishing, malware distribution or compromise) is not established. No brand impersonation and no conflicting legal identities were observed, because no identity pages were reachable. In sandbox testing, heavy third-party request traffic, very large page rearrangements after interaction and frequent script errors added to the cautionary picture. All external requests went to destinations known to be benign, and no wallet-drainer, clipboard-hijack, hidden-form or credential-exfiltration behaviour was detected. Evidence:

• Homepage: the access layer returned a block page titled as a suspected-phishing warning, with an access-denied response, and no site content was captured.
• Reputation: sixteen security engines rated the domain malicious and one suspicious. Three tier-one vendors were among them, and the threshold for the most severe reputational override was exceeded.
• Registration: the domain was registered on 2026-08-02, about 0.23 years (roughly three months) before this assessment.
• Sandbox behaviour (3 runs): 61 third-party XHR/fetch calls, 9 third-party POST requests, 22 console errors and a peak of 1,518 DOM mutations after interaction. No non-whitelisted external destinations, wallet interaction or clipboard writes were observed.

Regulatory Verification Notes

No legal, terms, privacy or about pages were reachable, so there is no on-site licence, company registration or named operator to assess. Disclosure status is therefore unclear, and it should not be read as evidence of a specific regulatory breach. Nothing on the site links it to a regulated entity, and no third-party broker-reputation match exists for it. Identity has not been independently connected to any real-world brand or person, so no claim of legitimacy can be supported. The registration was made through a mainstream registrar and the certificate is formally valid. Those facts show only that the site is technically well formed, and they do not offset the reputational findings. Evidence:

• Legal and identity pages: none were captured because the homepage returned only a security block page.
• Registrar: Spaceship, Inc., with registration running to 2027-08-02.
• Transport security: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-29.
• Hosting network: AS13335 (Cloudflare, Inc., US).

What to Verify Next

The site should not be treated as a business counterparty until the source and nature of the detections are understood. Confirm through an independent route whether the domain belongs to a known publisher. Any link to the domain that arrived by email, message or advertisement should be checked against the sender's official channels, not the link itself. If a business relationship is being considered, an independent registry or corporate lookup for the claimed operator is the appropriate check. Re-testing the domain after the security vendors' listings change would show whether the warnings were cleared or the site was cleaned. Evidence:

• Homepage: no operator name, contact channel or legal entity was visible to verify against.
• Reputation: the detections are unspecific, so the type of abuse remains unconfirmed.
• Registration: the domain is only a few months old, so there is little history to corroborate any claimed identity.

Summary Verdict

The overall posture is high risk. Independent security detections, a security warning shown to visitors and a very young registration converge on a critical assessment. Technical hygiene such as valid encryption does not offset these findings. Real-world operator identity is unverified, and no legitimacy can be inferred.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are CDN edge servers, so the origin host is not visible. The bot-protection layer is what produced the phishing-warning page. Edge-only visibility prevents independent confirmation of where the content is hosted and can mask rapid content changes. The protection is a mitigating factor only, and it cannot offset the reputational findings.

Closing Assessment

The site should be avoided for any login, credential entry, payment or download. At most, it should be opened only for read-only inspection in an isolated environment, and only if there is a specific reason to do so.