huabit[.]com

Analysis as of July 24, 2026 indicates that the domain huabit.com is actively hosting a cryptocurrency‑related scam that impersonates the Ethereum brand. The site returns HTTP 200 and presents the page title “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Huabit,” which confirms the intent to lure victims seeking legitimate crypto services. Registration data shows the domain was created on October 02, 2025 through Wild West Domains, LLC, and is served from the Cloudflare network (IP 172.67.190.220, AS13335, United States). The TLS certificate is issued by Google Trust Services under the WE1 branch, indicating a valid HTTPS configuration despite the malicious purpose. Infrastructure analysis reveals the use of jQuery libraries loaded from a CDN and the presence of HTTP/3, both typical of modern web services but not indicative of benign intent.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy, reinforcing the classification as a malicious resource. Reputation scoring from Gridinsoft assigns a trust score of 1 / 100, reflecting extreme distrust. VirusTotal scans show that three out of ninety‑five antivirus engines flag the domain, providing independent confirmation of malicious activity. No additional public threat‑intel feeds are referenced in the current data set. The exact payload or credential‑harvesting mechanisms have not been publicly disclosed, and the site’s internal structure has not been captured, so details such as form fields or redirect chains remain unknown.

Defenders should block DNS resolution for huabit.com at the network perimeter, add the IP address 172.67.190.220 to deny lists, and ensure that web filtering solutions incorporate the observed blocklist entry. Monitoring for outbound connections to Cloudflare‑hosted services originating from internal hosts that query the domain is advisable.