hotcoin-italy[.]at

This domain, hotcoin-italy.at, is identified as a cryptocurrency credential phishing site specifically designed to impersonate Hotcoin Exchange. The threat targets Italian-speaking users by presenting a fraudulent login portal titled 'Accesso Hotcoin Exchange - Login Sicuro | Accedi al Tuo Account Hotcoin,' which closely mimics the legitimate exchange’s authentication interface. Analysis indicates the domain is currently offline, though prior activity suggests it was actively harvesting user credentials for unauthorized account access. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered through Iqweb on February 27, 2026, an anomalous creation date likely intended to evade detection. It resolves to the IP address 186.2.175.29 and is flagged by 8 of 95 security vendors on VirusTotal, including detection by PhishDestroy. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100. Detected technologies include Ant Design, jQuery, Hammer.js, and DDoS-Guard, the latter often associated with bulletproof hosting environments used to obscure malicious infrastructure. Given the domain’s current offline status, immediate risk of active credential harvesting is mitigated. However, organizations and users should remain vigilant, as phishing infrastructure often resurfaces under similar domains. Recommendations include monitoring for domains with identical naming patterns (e.g., 'hotcoin-[region]'), blocking the IP address 186.2.175.29 at the network level, and implementing multi-factor authentication on all cryptocurrency exchange accounts. Security teams should also review logs for connections to this IP or domain to identify potential prior exposure.