hdgsqo[.]pinksale-finance[.]info

This domain, www.hdgsqo.pinksale-finance.info, is flagged for brand impersonation targeting CEX IO, a cryptocurrency exchange platform. The threat type involves credential harvesting through a fraudulent login page titled 'CEX io Prijava Berza | cex io login,' designed to mimic the legitimate CEX IO interface. Current status indicates the domain is offline, though prior activity suggests malicious intent to capture user credentials. Analysis indicates the domain was created on February 21, 2026, and registered through NameSilo, LLC. It resolves to the IP address 186.2.175.33, located in Belize (AS59692 IQWeb FZ-LLC). The domain appears on one security blocklist and is flagged by 17 of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to lend superficial legitimacy to phishing sites. Infrastructure analysis reveals the domain was blocked by at least one security entity prior to being taken offline. The domain is currently offline, reducing immediate risk to users. However, the infrastructure and registration details suggest potential for reemergence or reuse in similar campaigns. Organizations and individuals are advised to block the domain and associated IP (186.2.175.33) at the network level. Users should verify the authenticity of login pages by cross-referencing URLs with official sources and enabling multi-factor authentication (MFA) on accounts. Security teams should monitor for related domains registered through NameSilo or resolving to the same IP range.