cortex-trading[.]io

Analysis indicates that cortex-trading.io was registered on 21 February 2026 and quickly pointed to the IP address 104.21.96.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. SSL inspection shows the site used a Cloudflare‑issued TLS certificate (Cloudflare TLS Issuing ECC CA 1), confirming the use of Cloudflare’s edge network for HTTPS termination. The page title returned by the server, “Cortex Trade | Automated Cryptocurrency Trading Powered by AI,” suggests a cryptocurrency‑trading service, while the intelligence explicitly marks the site as a crypto‑scam that impersonates the Aave brand.

VirusTotal analysis recorded a single positive detection out of 93 scanning engines, indicating at least one vendor flagged the domain as malicious. Reputation services assign very low confidence scores: Scamadviser rates the site 6/100 and Gridinsoft assigns 0/100, both reflecting a high likelihood of fraudulent activity. The domain’s current operational status is offline, which may be the result of takedown actions or automated shutdown by security tooling. Despite the offline state, the infrastructure footprint remains observable; the hosting provider and IP address continue to be associated with the malicious campaign and could be reused for future impersonation attempts.

Defensive recommendations include adding the domain and its resolving IP to blocklists at the perimeter, monitoring Cloudflare‑origin traffic for similar pattern, and configuring web‑gateway filters to deny any HTTP(S) request to cortex‑trading.io. Continuous threat‑intel feeds should be consulted for any re‑registration of the domain or emergence of related aliases targeting the Aave brand.