Is ethmp.cc a scam? TrustSniffer's high-risk assessment: 16/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

ethmp.cc is a recently registered website on the uncommon .cc country-code domain. It serves a minimal single-page homepage with only a short block of text. That text does not clearly describe a product, service, or business model, so the site's apparent purpose cannot be established from what it presents to a visitor.

Scam/Impersonation Risk

This is the decisive section of the assessment, because contradictory signals are present. The domain is blacklisted by external threat-intelligence sources. Several independent detection engines classify it as malicious or suspicious, including at least one recognised tier-one security vendor. This is a confirmed reputational finding, not an inference. The protective infrastructure in front of the site does not offset it. Within the observed evidence there is no sign of conflicting legal identities, and no brand impersonation or phishing page was confirmed in the captured content. The risk therefore rests on the external listings and on the domain's very recent creation, not on anything visible on the page. Automated browsing of the homepage did not trigger wallet-drainer behaviour, clipboard manipulation, hidden or externally posting password forms, or content cloaking. These are mitigating observations about the captured page and do not cancel the listing. The page's heavy reliance on third-party requests means its content and behaviour could change quickly, which the short history gives no way to rule out. Evidence:

• Homepage and domain-level reputation: multiple independent engines flag the domain as malicious or suspicious, including one tier-one vendor, and an external blacklist is active.
• Domain registration record: registered 2026-06-21, about 0.35 years (126 days) old at assessment, which falls within the high-scrutiny window for newly created domains.
• Homepage behavioural analysis: 3 of 3 sandbox runs completed with no wallet-drainer, clipboard-write, hidden-form, or cloaking activity. About 39 external XHR requests were observed, all to whitelisted destinations.

Regulatory Verification Notes

The captured homepage carries only about 850 characters of text. It names no operating company or licence, and it offers no registration number or regulator reference. The assessment found no dedicated legal, terms, or about page that would let a visitor tie the site to an accountable entity. No third-party broker or regulatory-database match exists for the domain. The registration record also shows incomplete or withheld registrant details, so ownership is opaque. This is an ownership-opacity matter, not an identity contradiction. Both points are verification gaps and not proof of wrongdoing on their own. Together with the confirmed external listings, they leave no counterweight of legitimacy evidence. Evidence:

• Homepage: no company name, licence, or registration reference appears in the captured text.
• Registrar record: the domain is registered through Spaceship, Inc., created 2026-06-21 and set to expire 2027-06-21, with registrant details incomplete.
• Hosting: served from AS13335 (Cloudflare, Inc., US), a hosting provider that is common to many legitimate and malicious sites alike.
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-15. This confirms an encrypted connection but says nothing about who operates the site.

What to Verify Next

Any intended interaction should wait until the external listings are resolved or credibly explained. A reviewer should re-check the domain against several independent threat-intelligence sources to see whether the flags persist or have been cleared. The reviewer should then confirm through an independent route, such as an official channel of a known organisation, that the domain really belongs to the entity it might claim to represent. If the site later publishes a company name or licence, that claim should be checked against the relevant public registry before it is trusted. Official support and contact channels should also be confirmed offline, not through links on the site. Evidence:

• Homepage: it presents no verifiable operator, so any identity claim has to come from outside the site.
• Domain reputation: the current third-party detections are the key item to re-test on a later date.
• Domain registration record: the domain's first-year age means any history or reputation must be built from fresh evidence.

Summary Verdict

The site is assessed as high-risk. Confirmed external threat detections, a newly created domain, and the absence of any identifying disclosure outweigh the technically sound but generic transport security. Nothing in the evidence establishes who operates the site or why it exists, and the posture is clearly cautionary.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF. All four observed addresses are Cloudflare edge servers, and the origin host was not observable. This is a mitigating factor only, because shared edge infrastructure is available to any customer and does not indicate legitimacy. It also prevents independent confirmation of where the content is hosted.

Closing Assessment

The site should be treated as unsafe for any sign-in, credential entry, wallet connection, or payment until the external listings are removed and the operator is independently identified. Any contact should be limited to passive viewing from an isolated, non-sensitive environment.