cart-stage[.]blocks-games[.]top

Analysis of cart-stage.blocks-games.top indicates that the domain was registered on March 12, 2024 through NameSilo, LLC and is hosted on the IP address 186.2.175.33, which belongs to AS59692 (IQWeb FZ-LLC) in Belize. The site presented the page title “CEX io Prijava Berza | cex io login”, suggesting an attempt to harvest credentials for the CEX.io cryptocurrency exchange. No TLS certificate was observed, confirming that the service was delivered over plain HTTP. VirusTotal records show that 15 of 95 scanning engines flagged the domain as malicious, reinforcing the credential‑phishing classification.

The domain is resolved by Cloudflare authoritative nameservers isaac.ns.cloudflare.com and faye.ns.cloudflare.com, a pattern often used to obscure hosting details. It currently appears on a single public blocklist and has been listed by PhishDestroy, indicating that at least one security community has taken mitigation action. The domain is presently offline, which may be due to takedown efforts or the operators abandoning the campaign. Uncertainty remains regarding the full scope of the phishing infrastructure, such as whether additional domains share the same IP or whether the site employed any redirect chains before being taken down.

No evidence of a valid SSL certificate, JavaScript obfuscation, or known phishing kits was found in the supplied data. Defenders should continue to monitor the IP address 186.2.175.33 for new hostnames, enforce blocklist updates that include this domain, and ensure that any traffic to the associated CEX.io login page is inspected for credential‑harvesting attempts. Network‑level controls that block outbound connections to the IP or to the hostnames resolved by the Cloudflare nameservers can reduce exposure. Organizations that have users with CEX.io accounts should advise them to change passwords and enable multi‑factor authentication if not already enabled.