cex-io-user-login[.]at

This domain, cex-io-user-login.at, is a credential phishing infrastructure designed to harvest login credentials from users attempting to access the legitimate CEX.IO cryptocurrency exchange platform. The domain mimics the official CEX.IO login interface, presenting a page titled 'CEX io Prijava Berza | cex io login,' which targets users through localized language deception. Analysis indicates the domain is engineered to capture usernames, passwords, and potentially two-factor authentication codes, enabling unauthorized access to victim accounts and subsequent theft of digital assets. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on February 27, 2026, through the registrar Iqweb, and resolves to the IP address 186.2.175.29, hosted on AS59692 (IQWeb FZ-LLC) in Belize. Security vendor detection on VirusTotal shows 17 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The domain uses a Let's Encrypt SSL certificate (R12), which, while providing HTTPS encryption, does not validate legitimacy. The hosting provider and registration details align with patterns observed in credential phishing campaigns targeting financial platforms. Users who visited cex-io-user-login.at should immediately revoke any active sessions on the legitimate CEX.IO platform and change their login credentials. Enable multi-factor authentication using an authenticator application rather than SMS-based verification. Monitor account activity for unauthorized transactions and report any suspicious behavior to the platform's security team. If credentials were entered on this domain, assume they are compromised and avoid reusing them across other services. Security teams should block the domain and associated IP address (186.2.175.29) at the network perimeter to prevent further access attempts.