poloniex-login[.]at

This domain, poloniex-login.at, was identified as a credential phishing site impersonating the Poloniex cryptocurrency exchange, as indicated by its page title 'Poloniex Login Area | Exchange Sign In.' Registered on February 27, 2026, through Iqweb, the domain resolved to the IP address 186.2.175.29, hosted on AS59692 (IQWeb FZ-LLC) in Belize. No SSL certificate was detected, increasing the risk of unencrypted credential interception. Technologies identified on the site include Vue.js, jQuery, and Hammer.js, alongside DDoS-Guard, which may be used to obscure hosting origins or mitigate takedown efforts. Analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy.

The domain is currently offline, though its prior operational status and infrastructure suggest it was actively used for phishing. Nameservers associated with the domain (pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, pns74.cloudns.uk) are consistent with bulletproof or low-reputation hosting providers, which are frequently leveraged for malicious campaigns. Defenders should treat this domain as high-risk for credential theft targeting Poloniex users. While the site is offline, historical DNS and WHOIS records should be preserved for forensic analysis.

Monitoring for re-registration or reuse of the same IP, nameservers, or hosting provider is recommended. If internal logs indicate user interaction with this domain, credentials should be considered compromised and reset immediately. No further details about the phishing kit's functionality or backend infrastructure are available at this time.