birrbit[.]com

The domain birrbit.com was registered through Dynadot LLC on February 21, 2026. The registration record shows the domain was created less than five months ago, indicating a relatively new infrastructure. The authoritative nameservers are lochlan.ns.cloudflare.com and stephane.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS service. No additional registrant details are disclosed in the public WHOIS data.

Technical resolution points to the IPv4 address 165.232.78.158, which belongs to Autonomous System AS14061 operated by DigitalOcean, LLC and is geolocated in Germany. The server presents a valid Let’s Encrypt TLS certificate (R12) and negotiates modern cipher suites, confirming a functional HTTPS endpoint.

An HTTP GET to the root URL returns a 200 status code and the page title is reported simply as birrbit.com. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. The risk level is currently marked as under_investigation and the domain status is listed as active. VirusTotal reports 0 detections out of 95 scanners, and the Gridinsoft trust score is 0 out of 100, which does not imply safety but reflects limited exposure in those services.

Given the recent creation date, active hosting, and inclusion in a phishing blocklist, the domain should be treated as a live threat. Defenders are advised to add both the domain and its IP address to outbound filtering rules, monitor DNS queries for lookups to birrbit.com, and ensure that any credential capture attempts are flagged. Organizations should also consider sharing the observed indicators with relevant information‑sharing groups to improve community‑wide detection and maintain continuous re‑evaluation as additional intelligence becomes available.