assets[.]kivvibank[.]com

This domain, assets.kivvibank.com, is identified as a brand impersonation threat targeting CEX IO, a cryptocurrency exchange platform. The phishing page mimics the official CEX IO login interface, using the title 'CEX io Prijava Berza | cex io login,' which suggests an attempt to deceive users into entering credentials. No cryptocurrency drainer kit signatures were detected in initial scans, but the presence of a login portal indicates a likely credential harvesting operation. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GMO Internet Group, Inc. d/b/a Onamae.com. It resolves to the IP address 186.2.175.33, hosted under AS59692 (IQWeb FZ-LLC) in Belize. The domain lacks an SSL certificate, a common red flag in phishing campaigns. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while only one security blocklist currently includes it. Google Safe Browsing does not list the domain at the time of analysis. The domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains registered, and similar campaigns may re-emerge under new domains. Response actions include blocking the domain across security platforms and monitoring for related registrations under the same registrar or hosting provider. Users are advised to verify domain authenticity before entering credentials and to enable multi-factor authentication on cryptocurrency platforms to mitigate credential theft risks.