pontos-rowbit[.]com

This domain, pontos-rowbit.com, is identified as a brand impersonation phishing site targeting users of the Rowbit platform, a cryptocurrency service. The page title, 'Pontos Rowbit | Hivatalos weboldal Magyarország 2026,' explicitly mimics official Rowbit branding, suggesting an attempt to deceive Hungarian-speaking users into believing the site is legitimate. No specific drainer kit signatures were observed in the available telemetry, but the domain exhibits characteristics consistent with credential harvesting or fraudulent transaction facilitation, common in cryptocurrency-related phishing campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through the registrar NETIM SAS. It resolves to the IP address 94.26.38.51, geolocated in Bulgaria and associated with AS202412 (Omegatech LTD). Detection metrics indicate elevated risk: the domain is flagged by 14 out of 95 security vendors on VirusTotal and appears on one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E8), provides basic encryption but does not validate the site's legitimacy. No detections were reported in Google Safe Browsing at the time of analysis. The domain has been taken offline, reducing immediate exposure risk. However, the infrastructure remains registered, and the registrar has not suspended the domain at the time of this report. Users who interacted with the site prior to its takedown should assume credentials or transaction details may have been compromised. Affected individuals are advised to revoke active sessions, monitor for unauthorized transactions, and report the incident to relevant financial or cryptocurrency platforms. The domain's creation date and rapid detection suggest a short-lived but targeted campaign, emphasizing the need for continued vigilance against similar impersonation attempts.