ethereumproair[.]app

The domain ethereumproair.app is identified as a brand impersonation threat specifically targeting Ethereum, the cryptocurrency platform. This domain was designed to mimic official Ethereum services, presenting itself as an AI-powered trading platform under the names Ethereum ProAir 24 and Ethereum ProAir 360. Current status indicates the domain has been taken offline, though prior activity suggests malicious intent to deceive users seeking legitimate Ethereum-related services. Analysis of available data reveals multiple indicators of compromise. The domain was flagged by 19 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. Infrastructure analysis shows it was registered through Cloudflare, Inc., and resolved to the IP address 212.92.105.101, located in the Netherlands under AS43350 (NForce Entertainment B.V.). The domain appears on one security blocklist and lacks an SSL certificate, further reducing its legitimacy. The page title explicitly claimed affiliation with Ethereum, using the phrase 'Ethereum ProAir 24 & Ethereum ProAir 360 (Ai) version | Official Website' to mislead visitors. Given the domain's current offline status, immediate interaction risks are mitigated; however, the infrastructure remains a documented threat. Users and organizations are advised to treat any prior or future communications referencing ethereumproair.app as fraudulent. Network administrators should update blocklists to include this domain and its associated IP address. Individuals who may have engaged with the site should monitor for unauthorized transactions, reset credentials for related accounts, and report the incident to relevant cybersecurity authorities for further investigation.