cex-io-login[.]at

This domain, cex-io-login.at, is a credential phishing site designed to steal CEX.IO exchange account credentials. Visitors are presented with a fake login page titled 'CEX io Login Exchange | Sign In to CEX Account Dashboard,' which closely mimics the legitimate CEX.IO interface. The site captures entered usernames and passwords, enabling attackers to gain unauthorized access to cryptocurrency exchange accounts, withdraw funds, or conduct further fraudulent transactions. The threat primarily targets users who believe they are accessing their legitimate CEX.IO dashboard, making it a high-risk impersonation attack. Analysis indicates this domain was registered on February 27, 2026, through the registrar Iqweb, an unusual creation date suggesting potential domain spoofing or backdating. The site resolves to the IP address 186.2.175.29, located in Belize under AS59692 (IQWeb FZ-LLC), a network segment frequently associated with malicious hosting. At the time of assessment, 17 out of 95 security vendors on VirusTotal flagged this domain as malicious, confirming its use in phishing campaigns. Additionally, the domain lacks an SSL certificate, a critical red flag for any site handling sensitive login credentials, as it exposes user data to interception during transmission. If you visited cex-io-login.at and entered your login details, immediate action is required to mitigate risk. First, change your CEX.IO password and enable multi-factor authentication (MFA) if not already active. Review your account for unauthorized transactions or changes, such as linked withdrawal addresses or API keys. Monitor connected email accounts for suspicious activity, as compromised credentials may be used to reset passwords for other services. Report the incident to CEX.IO support and consider filing a report with local cybercrime authorities. Avoid interacting with the domain further, as it remains a confirmed phishing infrastructure despite its current offline status.