digifinex-login[.]at

The domain digifinex-login.at has been identified as a credential theft resource specifically targeting users of the Digifinex cryptocurrency exchange. Analysis confirms this domain engages in brand impersonation, presenting a fraudulent login interface labeled 'Digifinex Login - Secure Bitcoin' to harvest user credentials. As of the latest verification, the domain has been taken offline, though prior activity remains a documented security concern. Infrastructure analysis reveals the domain was registered through Iqweb on February 27, 2026, an anomalous creation date suggesting potential falsification or typo-squatting. It resolved to the IP address 186.2.175.29 and was detected utilizing technologies including jQuery, Hammer.js, and DDoS-Guard, which may indicate attempts to evade detection or mitigate takedown efforts. The domain appears on one security blocklist and has been flagged by 12 of 95 security vendors on VirusTotal, while Gridinsoft assigns it a trust score of 0 out of 100. The presence of these indicators, combined with the specific targeting of Bitcoin-related credentials, elevates the risk profile of this campaign. Current status indicates the domain is offline, though similar impersonation attempts may persist through newly registered or previously undetected resources. Organizations and individuals are advised to monitor for domains registered through Iqweb with anomalous creation dates, particularly those resolving to 186.2.175.29 or utilizing DDoS-Guard infrastructure. Users should verify exchange login portals via official channels and implement multi-factor authentication to mitigate credential theft risks. Security teams are encouraged to update blocklists with the provided indicators and conduct retrospective analysis for potential prior exposure.