blackbit-exchange-login[.]com

The domain blackbit-exchange-login.com is actively hosting a credential‑phishing site targeting exchange accounts. HTTP requests return status 200 and the default Apache2 Ubuntu page titled “Apache2 Ubuntu Default Page: It works”, indicating no overt phishing page was captured at the time of analysis. The site presents an SSL certificate issued to PhishDestroy / botadmin.destroy.tools, and resolves to the loopback address 127.0.0.1, a technique often used to evade external scanning. Nameservers are dns1.regway.com, dns2.regway.com, dns3.regway.com, and dns4.regway.com, and registration occurred on May 23 2026 via PDR Ltd. d/b/a PublicDomainRegistry.com. Threat intelligence records show the domain appears in one AlienVault OTX pulse and is listed on four external blocklists; Gridinsoft assigns a trust score of 0/100. VirusTotal reports a single positive detection out of 91 scanners. The scam type is identified as a “Fake Exchange”. Current status remains active and the risk level is high. Defenders should immediately block network traffic to the domain and add it to endpoint and DNS deny‑list filters. Continuous monitoring of DNS queries for the listed nameservers is advised, as is correlation of any authentication attempts to exchange services with this host. Because the site returns only a default Apache page, additional payloads may be deployed later; therefore, periodic re‑assessment of the URL content is recommended.