deepcoin[.]at

Analysis indicates that the domain deepcoin.at is currently active and serves a credential‑phishing page titled “Deepcoin Login | Official Crypto Exchange Portal | Deepcoin Sign In”. The site is protected by a Let’s Encrypt R13 certificate and returns HTTP 200 responses. DNS resolution points to IP 185.149.120.107, which is allocated to AS57724 DDOS‑GUARD LTD in Russia. The same IP is listed on a single security blocklist and the domain is catalogued by PhishDestroy as blocked. Reputation services assign a trust score of 15/100 on Scamadviser and 0/100 on Gridinsoft, reinforcing the malicious assessment. VirusTotal scans show nine of ninety‑five antivirus engines flag the domain, indicating observed malicious behavior. The web stack includes Vue.js, jQuery, Hammer.js and the DDoS‑Guard protection layer, a combination often observed in phishing infrastructure. Nameservers pns61.cloudns.net, pns62.cloudns.com, pns63.cloudns.net and pns64.cloudns.uk are publicly visible, but no further hosting details are disclosed. While the page content has not been manually inspected, the convergence of phishing‑specific indicators—credential‑phishing classification, low reputation scores, blocklist presence, and multiple vendor detections—strongly suggests that the site is being used to harvest login credentials for a crypto exchange. Defenders should block outbound connections to 185.149.120.107, add deepcoin.at to local deny lists, monitor for related DNS queries, and alert users about the fraudulent login portal. Ongoing observation is advised to detect any changes in hosting or additional malicious payloads.