wwapi[.]pinksale-finance[.]info

The domain wwapi.pinksale-finance.info has been identified as a brand impersonation phishing site specifically targeting users of the cryptocurrency exchange CEX IO. The site masquerades as a legitimate login portal, presenting itself under the page title 'CEX io Prijava Berza | cex io login,' which closely mimics the authentic CEX IO interface. Analysis confirms the domain is currently offline, though prior activity indicates a deliberate attempt to harvest credentials or facilitate unauthorized access to user accounts. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, a registrar commonly associated with malicious or high-risk domains. The site resolved to the IP address 186.2.175.33, hosted under AS59692 (IQWeb FZ-LLC) in Belize, a jurisdiction frequently linked to low-reputation hosting providers. Security telemetry indicates the domain was flagged by 16 of 95 vendors on VirusTotal, with a single entry on a security blocklist prior to takedown. The SSL certificate, issued by Let's Encrypt (R13), provided minimal assurance, as automated certificate issuance is often exploited by threat actors to lend superficial legitimacy to phishing infrastructure. Current status confirms the domain has been taken offline, though residual risk remains due to the potential reuse of associated infrastructure or registration patterns. Organizations and users are advised to implement the following mitigations: block the domain and IP 186.2.175.33 at perimeter security controls, monitor for credential reuse attempts from affected accounts, and deploy endpoint detection rules to identify access attempts to similar impersonation domains. Security teams should prioritize reviewing logs for connections to the IP or domain, particularly from systems that previously interacted with CEX IO. Proactive measures include enforcing multi-factor authentication (MFA) for all cryptocurrency exchange accounts and conducting user awareness training to recognize brand impersonation tactics.