ethereum-proair[.]co

This domain, ethereum-proair.co, was registered on April 27, 2026 through NETIM SAS and is currently active. The authoritative nameservers are OPHELIA.NS.CLOUDFLARE.COM and THOMAS.NS.CLOUDFLARE.COM, and the domain resolves to the Cloudflare‑owned IP address 104.21.35.159 located in Canada. The site presents an HTTP 403 response and displays the page title “Suspected Misleading Website | Cloudflare”. TLS is provided by a Google Trust Services / WE1 certificate, indicating use of Cloudflare’s SSL termination. MX records include at least mx10.antispam.mailspamprotection.com with priority 10; additional records are incomplete. Reputation scoring is extremely low, with a Gridinsoft trust score of 0/100. VirusTotal analysis shows that 9 of 91 scanned security vendors flagged the domain, and AlienVault OTX lists it in one threat‑intelligence pulse. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reflecting its classification as a brand‑impersonation campaign targeting the Ethereum brand. No public content analysis is available beyond the page title, so the exact tactics employed on the site remain unclear. Defenders should add ethereum-proair.co to deny‑list rules, enforce DNS blocking, and monitor for any outbound connections to its IP range. Continuous re‑scanning is advised to capture potential changes in payload or hosting. Given the high risk rating and the confirmed impersonation of a major blockchain brand, the domain should be treated as hostile infrastructure.