jrspvfge[.]pinksale-finance[.]info

This domain, www.jrspvfge.pinksale-finance.info, was identified as a brand impersonation threat targeting CEX IO, a cryptocurrency exchange platform. The site presented a login interface titled 'CEX io Prijava Berza | cex io login,' designed to deceive users into submitting credentials. As of the latest assessment, the domain has been taken offline, though prior activity suggests a focus on credential theft for unauthorized access to crypto wallets or exchange accounts. Analysis indicates the domain was registered on May 29, 2024, through NameSilo, LLC, and resolved to the IP address 186.2.175.33, hosted under AS59692 (IQWeb FZ-LLC) in Belize. Security vendors flagged the domain in 17 of 95 VirusTotal scans, while it appeared on one additional security blocklist. The SSL certificate, issued by Let's Encrypt (R12), provided a superficial layer of legitimacy, though its use in malicious infrastructure is well-documented. Infrastructure analysis reveals the domain leveraged a subdomain structure (pinksale-finance.info) to evade detection, a common tactic in phishing campaigns targeting financial or crypto-related brands. The domain's current offline status reduces immediate risk, but historical indicators warrant continued vigilance. Organizations and users are advised to block the domain and its associated IP (186.2.175.33) at the network level. Security teams should monitor for similar impersonation attempts using the same registrar (NameSilo) or hosting provider (AS59692). End-users should verify domain authenticity before entering credentials, particularly for crypto-related services, and enable multi-factor authentication to mitigate credential theft risks. If exposure is suspected, affected accounts should be locked, credentials rotated, and transaction histories reviewed for unauthorized activity.