cecpiww0u12d[.]blocks-games[.]top

This domain, cecpiww0u12d.blocks-games.top, is identified as a phishing resource impersonating the cryptocurrency exchange CEX.IO. The page title, 'CEX io Prijava Berza | cex io login,' explicitly mimics the legitimate login portal of CEX.IO, targeting users attempting to access their accounts. Analysis indicates this is a credential-harvesting campaign, likely designed to capture login credentials for subsequent unauthorized access to victim accounts. No evidence of a cryptocurrency drainer kit was observed in the available data, though the infrastructure aligns with typical phishing operations. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 21, 2026, through NameSilo, LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 186.2.175.33, hosted under AS59692 (IQWeb FZ-LLC), an autonomous system with a history of hosting phishing and fraudulent content. VirusTotal detection metrics show 13 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing (GSB) at the time of analysis. No SSL certificate is present, further degrading the site's legitimacy and increasing exposure to interception risks. As of the latest assessment, the domain has been taken offline, likely in response to detection and reporting. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to newly registered lookalike domains. Users who accessed the site prior to takedown should immediately revoke any entered credentials, enable multi-factor authentication on all financial accounts, and monitor for unauthorized transactions. Organizations are advised to update blocklists with the IP 186.2.175.33 and the domain pattern blocks-games.top to mitigate further exposure.