pymtdfqc[.]pinksale-finance[.]info

This domain, pymtdfqc.pinksale-finance.info, is identified as a credential theft operation targeting users of the cryptocurrency exchange CEX.IO. The site mimics the legitimate login interface of CEX.IO, presenting a page titled 'CEX io Prijava Berza | cex io login' to deceive visitors into entering their account credentials. Such impersonation schemes are designed to harvest sensitive information, which can lead to unauthorized access to user funds, identity theft, or further exploitation in subsequent attacks. The threat is classified as brand impersonation, a tactic frequently employed to exploit trust in well-known platforms. Analysis indicates that the domain was registered on February 21, 2026, through NameSilo, LLC, a registrar commonly associated with both legitimate and malicious domains. The domain resolves to the IP address 186.2.175.33, hosted under AS59692 (IQWeb FZ-LLC) in Belize. Security vendors on VirusTotal flagged this domain, with 17 out of 95 engines detecting it as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as malicious actors frequently use valid certificates to appear legitimate. The infrastructure analysis reveals a pattern consistent with phishing campaigns, including the use of subdomains under pinksale-finance.info, a domain historically linked to fraudulent activities. Users who visited pymtdfqc.pinksale-finance.info or entered credentials on the site should take immediate action to mitigate potential risks. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. If credentials were entered, users must change their passwords on the legitimate CEX.IO platform and any other services where the same credentials were reused. Enabling multi-factor authentication (MFA) on all accounts is strongly recommended to add an additional layer of security. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the legitimate platform's support team. For further protection, consider using a password manager to generate and store unique passwords, reducing the risk of credential reuse across multiple sites.