coinlocally-login[.]at

coinlocally-login.at was registered on February 27, 2026 and resolves to the IPv4 address 186.2.175.29. The address is assigned to AS59692, operated by IQWeb FZ-LLC and geolocated to Belize. Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, indicating a highly suspicious host. The domain is served through four CloudNS nameservers (pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, pns74.cloudns.uk). The site presents a login interface titled “Coinlocally Sign In Portal — Login Exchange Access”, directly mimicking the legitimate Coinlocally exchange login page. The page loads over HTTPS with a Let’s Encrypt R13 certificate, and returns HTTP 200. Front‑end libraries detected include jQuery and Hammer.js, and traffic is routed behind a DDoS‑Guard protection layer, a pattern frequently observed in credential‑phishing deployments. VirusTotal analysis reports that 4 of 95 security vendors have flagged the domain, and the domain appears on one public blocklist. PhishDestroy has already added the domain to its takedown list, confirming active malicious use. The observed characteristics—fresh domain age, low trust score, use of a reputable SSL provider to gain user confidence, and replication of a known exchange login—align with a high‑risk credential‑phishing campaign targeting cryptocurrency traders. Open questions remain regarding the ultimate command‑and‑control infrastructure and whether the IP address is shared with other malicious actors, as no additional intelligence on related domains or hosting patterns has been disclosed. Nonetheless, the current evidence is sufficient to classify the domain as a high‑confidence phishing vector. Defenders should block the domain and its resolving IP at network perimeter, monitor for similar login‑page clones, and enforce multi‑factor authentication for any Coinlocally accounts to mitigate credential compromise.