ethereumevexaipro-com[.]trackfinanceworld[.]com

The domain ethereumevexaipro-com.trackfinanceworld.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Ethereum brand. DNS resolution points to the IP address 104.26.8.162, which is hosted by Cloudflare, Inc. (AS13335) and geolocated to the United States. HTTP requests to the domain return a 302 status code, indicating a redirection, and the TLS certificate is issued by Google Trust Services under the WE1 certificate authority, confirming the use of a valid SSL chain. The site employs Google Hosted Libraries, Google Font API, and Cloudflare services, as identified by technology fingerprinting. Registration data shows the domain was created on 30 January 2025 through MainReg INC., and the authoritative nameservers are conrad.ns.cloudflare.com and fish.ns.cloudflare.com. VirusTotal analysis records five detections out of ninety‑five scanners, and the domain is listed on one security blocklist. It has been blocked by PhishDestroy and receives a Gridinsoft trust score of 0 out of 100. While the page title—"Ethereum Evex Ai Pro ™ - Die offizielle App-Website 2025 [AKTUALISIERT]"—explicitly references Ethereum, no additional content has been publicly disclosed, leaving the exact malicious payload or credential‑capture mechanisms unverified. Defenders should prioritize blocking the domain and its associated IP address at network perimeters, update intrusion‑detection signatures to flag the observed redirection pattern, and monitor for any related sub‑domains or infrastructure reuse. Continuous observation of Cloudflare‑hosted assets and periodic re‑scanning are recommended to detect potential changes in the threat posture.