ethereum-cormax[.]co

This domain is flagged as a high-risk brand impersonation threat targeting Ethereum users. Analysis indicates the site masquerades as an official trading application, specifically promoting the "Ethereum Cormax 16X Official Trading App & Latest Ethereum 60 Cormax Version 6000," which likely delivers malware or harvests credentials under false pretenses. The threat type is classified as brand impersonation with malicious distribution capabilities, posing significant financial and operational risks to unsuspecting users. Infrastructure analysis reveals the domain ethereum-cormax.co was registered on February 21, 2026, through Key-Systems GmbH and resolves to the IP address 212.92.105.101, hosted on AS43350 (NForce Entertainment B.V.) in the Netherlands. The domain appears on three security blocklists and is actively blocked by multiple detection systems. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E8), a common tactic to lend superficial legitimacy to fraudulent sites. The page title explicitly references Ethereum and a non-existent "Cormax" product line, reinforcing the impersonation angle. Mitigation steps for this threat type include immediate domain blocking at the network level, particularly for endpoints resolving to 212.92.105.101. Organizations should update detection rules to include the domain, IP, and associated SSL certificate in threat intelligence feeds. Users should be educated to verify official Ethereum communications through verified channels only, avoiding third-party applications or links referencing unofficial product names like "Cormax." Security teams are advised to monitor for similar domain registrations under Key-Systems GmbH or hosting on AS43350, as these may indicate additional impersonation campaigns. If encountered, users should report the domain to relevant security platforms to aid in broader takedown efforts.