abubit[.]com

This domain, abubit.com, is actively impersonating a cryptocurrency trading platform as part of an investment scam operation. Registered on March 12, 2026, through a major registrar, the domain presents itself as a legitimate exchange under the page title 'Abubit | Cryptocurrency trading and invest platform.' Analysis indicates the site is designed to deceive users into depositing funds or sharing sensitive credentials, aligning with patterns observed in fake exchange schemes. Infrastructure analysis reveals the domain resolves to 104.21.30.144, hosted on Cloudflare's network (AS13335), a common tactic to obscure the true origin of malicious sites. The domain is protected by a Google Trust Services SSL certificate, which may lend a false sense of legitimacy to unsuspecting visitors. Despite returning an HTTP 403 status, the domain remains accessible through direct navigation, suggesting the operators are actively maintaining the infrastructure. Security vendor detections further support the malicious classification of abubit.com. As of July 12, 2026, 14 out of 95 security vendors on a major threat intelligence platform flag the domain as malicious. Additionally, the domain appears in 23 threat intelligence pulses, indicating widespread recognition of its fraudulent nature. It is also listed on three security blocklists, including specialized cryptocurrency and phishing defense systems. Defenders should treat this domain as high-risk and prioritize blocking or monitoring interactions with it. The use of Cloudflare nameservers and a valid SSL certificate complicates takedown efforts, but the domain's presence on multiple blocklists and its consistent flagging by security vendors provide actionable indicators for network-level protections. Given the domain's age and active status, organizations should remain vigilant for related infrastructure or similar impersonation attempts targeting cryptocurrency users.