pionex-auth[.]at

This domain, pionex-auth.at, is flagged as a generic phishing infrastructure targeting users of the Pionex cryptocurrency exchange. Analysis of the page title, "Pionex 登入交易所 - 安全可靠的 Pionex 帳戶登入系統," indicates a focus on Chinese-speaking victims, mimicking the legitimate Pionex login portal to harvest credentials. No specific drainer kit signatures were identified, but the use of jQuery and Hammer.js suggests a frontend designed to replicate interactive elements of the authentic platform. The domain does not exhibit overt cryptocurrency wallet drainer functionality but is optimized for credential collection, which could facilitate subsequent unauthorized access to exchange accounts and associated assets.

Technical indicators confirm elevated risk: the domain was registered on February 27, 2026, through the registrar Iqweb, an unusual future date likely intended to evade immediate detection or domain reputation checks. It resolves to the IP address 186.2.175.29 and is protected by DDoS-Guard, a service frequently associated with bulletproof hosting environments. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, providing HTTPS encryption to lend an appearance of legitimacy to the phishing page.

As of the latest verification, pionex-auth.at has been taken offline, likely in response to detection and reporting. However, residual risk remains due to the domain's registration status and the potential for infrastructure reuse. Users who accessed the site prior to takedown may have exposed login credentials, API keys, or two-factor authentication details. Affected individuals are advised to immediately revoke any active sessions, rotate credentials, and monitor linked accounts for unauthorized transactions. Security teams should treat the IP 186.2.175.29 and registrar Iqweb as indicators of compromise for proactive blocking and threat hunting. The future-dated registration suggests possible evasion tactics, warranting continued monitoring of newly observed domains with similar patterns.