auth--bitbuy-cda--cdn-azure[.]dora[.]run

This domain is flagged for impersonation phishing targeting cryptocurrency exchange users. Analysis indicates a high-fidelity replica of the legitimate Bitbuy login portal, designed to harvest user credentials and session tokens. The threat type is classified as elevated due to its targeted nature and the financial risk posed to victims. Infrastructure analysis reveals the domain was registered on December 02, 2020, through Alibaba Cloud Computing Ltd. (HiChina) and resolves to IP 35.71.143.143, hosted on Amazon Web Services (AS16509). The SSL certificate is issued by Amazon RSA 2048 M03, a common certificate authority exploited in phishing campaigns. VirusTotal detection shows 19 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is currently offline, though this status may change. Mitigation requires immediate action from security teams and end-users. Network-level blocking of the domain and its resolving IP (35.71.143.143) is recommended to prevent access. Organizations should deploy email and web filtering rules to detect and quarantine messages containing the domain or its subdomains. End-users must verify the legitimacy of login portals by cross-checking URLs against official sources and enabling multi-factor authentication (MFA) to mitigate credential theft. Incident responders should monitor for compromised accounts linked to this campaign and reset credentials for affected users.