cmepro[.]cc

Analysis of cmepro.cc shows a newly registered (April 28 2026) domain hosted on Cloudflare infrastructure (IP 172.67.209.30, located in Canada). The site presents a valid SSL certificate issued by Google Trust Services under the WE1 root, indicating normal TLS termination. DNS resolution uses the Cloudflare nameservers carlos.ns.cloudflare.com and meilani.ns.cloudflare.com, and HTTP responses return a 301 redirect. The domain is currently active and appears on three security blocklists, confirming ongoing malicious use. The page title advertises “CME Group: A decentralized trading platform with low fees and high liquidity”, yet the threat profile classifies the site as a fake exchange impersonating an investment scam. Scamadviser assigns a trust score of 16/100, Gridinsoft reports 0/100, and VirusTotal flags the domain with 5 out of 95 security vendors detecting malicious behavior. Blocklist entries from PhishDestroy, MetaMask, and SEAL further corroborate its phishing intent. Infrastructure analysis reveals the use of Vue.js and HTTP/3 on top of Cloudflare’s edge network, a common stack for rapidly deployed phishing pages. The registrar Gname.com Pte. Ltd. is known for low‑cost registrations, and the lack of additional hosting clues limits attribution. The high risk rating reflects the combination of brand impersonation, low trust scores, and active blocklist presence. Defenders should block cmepro.cc at network perimeter and update endpoint and email filters to include the domain and its associated IP address. Continuous monitoring of DNS queries for the Cloudflare nameservers can help detect future pivots. Because the site mimics legitimate financial services, user education campaigns should highlight the discrepancy between the advertised CME Group branding and the low‑trust scores observed. Threat intel feeds should be refreshed to capture any new indicators tied to this infrastructure.