azbit-login[.]com

Analysis of azbit-login.com indicates a credential-phishing domain impersonating Facebook, now offline as of July 23, 2026. The domain was registered on September 21, 2024, through NiceNIC International Group Co., Limited, and resolved to a single IP address, 185.149.120.107, hosted on AS57724 (DDOS-GUARD LTD) in Russia. No SSL certificate was present, a common red flag for phishing infrastructure. The page title, 'Azbit Login - Azbit Exchange Login To Account,' does not align with Facebook branding, suggesting either a misconfigured phishing kit or an attempt to masquerade as a cryptocurrency exchange while targeting Facebook credentials. Security vendor detections were notable but not unanimous: 12 of 95 engines on VirusTotal flagged the domain as malicious.

AlienVault OTX included it in one threat intelligence pulse, and the domain appeared on a single security blocklist. Scamadviser assigned a trust score of 1 out of 100, further corroborating its high-risk classification. The domain was blocked by PhishDestroy prior to being taken offline. Infrastructure analysis reveals reliance on a single nameserver, a pattern often observed in short-lived phishing campaigns. The use of DDOS-GUARD LTD, a provider frequently associated with bulletproof hosting, aligns with known tactics for evading takedowns.

While the exact phishing kit or lure mechanism remains unconfirmed, the domain’s registration details, hosting provider, and detection history collectively point to a credential-harvesting operation. Defenders should treat this domain as compromised and avoid whitelisting it in security controls. Historical DNS and WHOIS records may still yield indicators of compromise (IOCs) for retrospective hunting. Given the domain’s offline status, no immediate user risk remains, but similar infrastructure (e.g., same IP range, registrar, or hosting provider) should be monitored for re-emergence. Organizations are advised to review logs for prior connections to 185.149.120.