mbitexchange[.]com

Analysis indicates that the domain mbitexchange.com was registered on 13 December 2025 through BigRock Solutions Ltd. The authoritative name servers ns1.mbitexchange.com and ns2.mbitexchange.com resolve the zone to the single address 23.111.182.98. Current passive DNS shows the domain remains active, and the IP is presently listed on a single security blocklist. The phishing‑specific blocklist PhishDestroy has already marked the domain as malicious, confirming its use in credential‑harvesting campaigns. VirusTotal has recorded a single positive detection out of 91 scanning engines, providing additional confirmation that at least one security vendor has identified malicious behavior associated with the host.

The limited publicly available intelligence does not include a page title, SSL certificate details, HTTP status codes, or explicit references to a targeted brand. Consequently, the exact content and lure employed by the site cannot be described at this time. The lack of multiple detections suggests that the payload may be newly deployed or that the hosting configuration evades broader detection, but the presence of a confirmed blocklist entry and a positive VirusTotal scan justifies a high risk rating. Defenders should immediately add mbitexchange.com and the associated IP address 23.111.182.98 to outbound filtering and URL blocking policies.

Monitoring of DNS queries for the domain and its name servers is recommended to detect any downstream resolution attempts. Organizations using threat‑intel feeds should ensure the domain is ingested from PhishDestroy and from the observed blocklist. Continuous re‑scanning of the host on VirusTotal or similar services is advised to capture any escalation in detection counts. Given the active status and confirmed phishing classification, the domain should be treated as a high‑confidence indicator of compromise.