api[.]kivvibank[.]com

This domain is flagged as an elevated-risk brand impersonation phishing site specifically targeting CEX IO, a cryptocurrency exchange platform. The threat involves fraudulent login pages designed to harvest user credentials, as evidenced by the page title 'CEX io Prijava Berza | cex io login,' which mimics the legitimate CEX IO authentication portal. Brand impersonation in this context poses a significant risk of financial loss and unauthorized account access, particularly given the domain's focus on cryptocurrency users. Analysis indicates the domain was registered on February 21, 2026, through GMO Internet Group, Inc. d/b/a Onamae.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 186.2.175.33, located in Belize (BZ) under AS59692 (IQWeb FZ-LLC), an autonomous system with a history of hosting malicious infrastructure. The domain appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal, reflecting moderate detection coverage. Notably, the domain lacks an SSL certificate, a red flag for phishing sites attempting to evade HTTPS-based security controls. The creation date, set in the future, suggests potential domain squatting or an attempt to obscure registration timelines. Mitigation steps for this threat include immediate blacklisting of the domain and its associated IP (186.2.175.33) across all security gateways and endpoint protection systems. Network administrators should update intrusion detection/prevention systems (IDS/IPS) to block traffic to this domain and its IP, while also monitoring for internal hosts attempting to resolve or connect to it. Organizations should deploy email filtering rules to quarantine messages containing the domain or links to it, particularly those referencing CEX IO login pages. End users should be educated to verify domain authenticity before entering credentials, especially for cryptocurrency platforms, and to report any suspicious login pages to their security teams. Additionally, CEX IO users should enable multi-factor authentication (MFA) and monitor their accounts for unauthorized activity.