doneld-cc[.]at

The domain doneld-cc.at has been identified as a crypto credential phishing site specifically targeting users through brand impersonation of Donald Trump. Analysis of the page title, 'Donald CC - Donald Trump CC - Sign In,' confirms the intent to deceive victims into submitting cryptocurrency-related login credentials. The domain is currently offline but was previously active in phishing campaigns. Infrastructure analysis reveals the domain was registered on June 08, 2026, and resolved to the IP address 188.114.97.3. It appears on one security blocklist and has been referenced in four threat intelligence pulses on a major threat intelligence platform. VirusTotal reports 0 detections out of 95 vendors, indicating low initial detection rates. The SSL certificate is issued by Google Trust Services, which may have contributed to its perceived legitimacy during active operations. While the domain is currently offline, the infrastructure remains a potential risk for future reactivation. Organizations and individuals are advised to monitor for re-emergence of this domain or similar patterns, such as newly registered domains with political branding and cryptocurrency-related keywords. Network defenders should update blocklists to include this domain and its associated IP address. Users who may have interacted with the site should assume credential compromise and initiate password resets for any cryptocurrency platforms or services.