uzx-login[.]at

uzx-login.at was observed on July 24, 2026 as a credential phishing site impersonating an exchange login portal. The page title returned by the HTTP response was “UZX Exchange Login Dashboard – Secure Login”, indicating an attempt to lure victims into entering credentials. The domain was registered on February 27, 2026 through the registrar Iqweb and uses CloudNS nameservers (pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net, pns74.cloudns.uk). DNS resolution points to IP address 186.2.175.29, which belongs to ASN 59692, operated by IQWeb FZ‑LLC and geolocated to Belize. The host presented a valid Let's Encrypt certificate (R12), which does not mitigate the malicious intent.

Security telemetry shows that two of ninety‑three VirusTotal scanners flagged the site, and the domain appears on a single blocklist, currently listed by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the high risk assessment. Front‑end analysis identified Ant Design, Vue.js, jQuery, Hammer.js, and DDoS‑Guard, a stack commonly observed in phishing kits. The campaign is classified as a “Fake Exchange” scam, targeting users of cryptocurrency exchange platforms.

At the time of reporting the site is taken offline, but the infrastructure components—IP address, nameservers, and hosting provider—remain active and could be reused for future campaigns. Defenders should continue to block the domain and associated IP, add the nameserver hostnames to monitoring lists, and consider upstream filtering of traffic to the IQWeb ASN. Continuous observation of VirusTotal and other multi‑engine aggregators is advised to capture any re‑registration or new activity. The limited detection footprint (two vendor flags, one blocklist entry) suggests the campaign is in an early stage, but the combination of low trust score, targeted page title, and known phishing kit components warrants an elevated risk posture.