cex-io-login[.]com

Analysis of the domain www.cex-io-login.com indicates active brand-impersonation phishing targeting users of a cryptocurrency exchange, despite the domain's page title and infrastructure suggesting an association with CEX.io. The domain was registered on October 3, 2024, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 45.10.243.7. It is flagged by 14 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and BLP-Malware. The site's SSL certificate is issued by Let's Encrypt, a common but not inherently malicious provider. Detected technologies include jQuery, Hammer.js, and DDoS-Guard, the latter often associated with bulletproof hosting services. The domain's page title, 'CEX io Login - CEX Exchange Login To Account,' explicitly references CEX.io, a legitimate cryptocurrency exchange, yet the domain itself is not affiliated with the official platform. AlienVault OTX records show the domain in two threat intelligence pulses, further corroborating its malicious classification. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, recent registration, and detection by multiple security vendors confirms its role in phishing operations. Defenders should treat this domain as actively malicious. Blocking resolution to 45.10.243.7 and adding the domain to deny lists is recommended. Monitoring for related infrastructure, such as domains registered through the same registrar or resolving to the same IP, may help identify additional threats. Given the use of DDoS-Guard, defenders should also prepare for potential evasion tactics or resilience in the hosting infrastructure.