whitebit-web[.]at

This domain is flagged as a credential harvesting phishing site targeting cryptocurrency exchange users. The infrastructure is classified under a generic_phishing threat type with an elevated risk level, indicating active abuse potential. Analysis reveals the domain was designed to mimic legitimate login portals, specifically impersonating the WhiteBIT cryptocurrency exchange platform to harvest user credentials and sensitive account information. Infrastructure analysis reveals the domain whitebit-web.at resolves to the IP address 95.129.234.137, hosted under AS57724 (DDOS-GUARD LTD) with a geolocation in Russia. The domain is detected by 9 out of 95 security vendors on VirusTotal, and appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt (R13), a common tactic used to lend false legitimacy to phishing sites. The page title, 'WhiteBIT Login | Secure Account Access & Manage Crypto Portfolio,' closely mirrors official branding to deceive users. Mitigation steps for this specific threat type include immediate domain takedown requests to hosting providers and certificate authorities, as well as blacklisting the domain and associated IP across security gateways. Organizations should implement multi-factor authentication (MFA) for cryptocurrency exchange access to reduce the impact of credential theft. Users should verify domain authenticity by cross-checking URLs with official exchange communications and avoid entering credentials on untrusted sites, even if they appear visually identical to legitimate platforms. Network-level blocking of the IP 95.129.234.137 and monitoring for related domains under the same registrar or hosting provider is recommended.