pionex-user[.]at

This domain is flagged as an elevated-risk generic phishing site designed to harvest cryptocurrency exchange credentials. Analysis indicates the infrastructure mimics legitimate Pionex login portals, presenting users with fraudulent authentication forms under the title 'Pionex Inloggen Exchange - Veilige Pionex Account Inlog.' The specific threat involves credential theft, where entered usernames and passwords are captured for unauthorized account access and fund theft. Infrastructure analysis reveals multiple high-risk indicators. The domain pionex-user.at was registered through Iqweb on February 27, 2026, an anomalous creation date suggesting potential domain spoofing. It resolves to IP address 186.2.175.29 and employs DDoS-Guard, a service commonly associated with bulletproof hosting environments. The site uses a Let's Encrypt SSL certificate, providing superficial encryption while remaining flagged by 4 out of 95 security vendors on VirusTotal. It appears on one security blocklist and is actively blocked by PhishDestroy. Additional technologies detected include jQuery and Hammer.js, which may facilitate dynamic content manipulation for phishing purposes. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the domain's malicious classification. To mitigate risks associated with this credential-harvesting phishing site, users should immediately cease all interaction with pionex-user.at. Organizations should update web filtering rules to block the domain and its associated IP address 186.2.175.29 at the network perimeter. Cryptocurrency exchange users are advised to verify login portals exclusively through official channels, checking for HTTPS certificates issued to the legitimate entity. Enable multi-factor authentication on all exchange accounts to prevent unauthorized access even if credentials are compromised. Security teams should monitor for credential stuffing attempts using harvested login pairs and conduct internal phishing awareness training emphasizing cryptocurrency exchange impersonation tactics.