picol-login[.]at

Analysis of picol-login.at, observed as offline on the report date of July 24, 2026, identifies a confirmed credential phishing operation. The domain was registered on February 27, 2026 through the registrar Iqweb and resolves to IP address 186.2.175.29, which is allocated to AS59692 IQWeb FZ-LLC and geolocated to Belize. The hosting infrastructure is served by Cloudns nameservers (pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, pns74.cloudns.uk), a configuration frequently associated with disposable or rapidly‑re‑hosted malicious sites. The site presented a TLS certificate issued by Let’s Encrypt (R13), indicating the use of a free, automated certificate without further validation. A Gridinsoft trust score of 0 / 100 underscores the lack of reputational confidence in the host.

The page title, "Picol Login | Unified Access to Advanced Crypto Trading," suggests a targeted lure toward cryptocurrency traders, though the content of the landing page has not been examined. Security telemetry shows the domain appears on a single blocklist and is blocked by PhishDestroy. VirusTotal recorded 2 detections out of 93 scanning engines, confirming that at least a minority of security vendors have flagged the domain as malicious. Detected client‑side libraries include jQuery, Hammer.js, and DDoS‑Guard, the latter possibly employed to mitigate takedown attempts.

While the offline status limits immediate threat interaction, defenders should continue to monitor the associated IP range and nameserver set for new domains that may reuse the same infrastructure. Network defenses should enforce outbound filtering for connections to 186.2.175.29 and block any future resolutions of picol-login.at. Email security gateways should add the domain to blocklists and apply heuristic detection for credential‑phishing attempts referencing "Picol Login" or related crypto‑trading terminology.