allinx-login[.]at

The domain allinx-login.at was registered on February 27 2026 through the registrar Iqweb. Its authoritative name servers are pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, and pns74.cloudns.uk, indicating use of the CloudNS DNS service. DNS resolution points to the single IPv4 address 186.2.175.29, which belongs to AS59692 operated by IQWeb FZ-LLC and is geolocated to Belize. The address appears on one public blocklist and is listed as blocked by PhishDestroy, confirming that at least one security feed has identified the host as malicious.

No TLS certificate is presented for the site, meaning any HTTP connection would be unencrypted, a common characteristic of credential‑phishing infrastructure. The page title returned by the HTTP response is “All InX Login | Secure Exchange Account Sign In”, which aligns with the reported scam type of a “Fake Exchange”. VirusTotal analysis shows that one of ninety‑three scanning engines flagged the domain, providing additional independent evidence of suspicious behavior. The domain is currently taken offline, so active probing is not possible, but historical evidence suggests it was used to harvest credentials for a Microsoft Exchange‑like service.

Defenders should add the domain and its IP address to block lists, monitor for any DNS queries or HTTP requests to the listed nameservers, and consider reviewing logs for connections to 186.2.175.29. Because the site lacks SSL, any credential capture would have occurred over cleartext HTTP, so network‑level inspection of outbound traffic for plaintext login fields may reveal compromised accounts. The limited visibility—only a single blocklist entry and one VirusTotal detection—means the full scope of the campaign is uncertain; however, the concrete indicators present justify a precautionary block and continued observation for related infrastructure.