bot-beta[.]pinksale-finance[.]info

The domain bot-beta.pinksale-finance.info has been confirmed as a brand impersonation phishing site targeting CEX IO, a centralized cryptocurrency exchange. Analysis indicates the site mimics CEX IO’s login interface, as evidenced by the page title “CEX io Prijava Berza | cex io login,” which suggests an attempt to harvest user credentials. The domain is currently offline, though prior activity and infrastructure details remain relevant for threat assessment. Technical indicators reveal the domain was registered through NameSilo, LLC, with a creation date of February 21, 2026. It resolves to the IP address 186.2.175.33, hosted on AS59692 (IQWeb FZ-LLC) in Belize. VirusTotal detection metrics show 18 of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist, specifically PhishDestroy, further corroborating its phishing classification. Infrastructure analysis suggests the threat actor leveraged low-cost hosting and domain registration to deploy the phishing page. While the domain is currently offline, organizations and users should remain vigilant for similar impersonation attempts. Recommended actions include blocking the domain and associated IP at the network level, monitoring for credential theft attempts linked to CEX IO, and educating users on identifying phishing indicators. Security teams should also review logs for prior connections to 186.2.175.33 or related domains registered via NameSilo with similar naming patterns.