bituni-web[.]created[.]app

The domain bituni-web.created.app is currently classified as a high‑risk generic phishing infrastructure. DNS resolution points exclusively to the IPv4 address 216.150.1.1, and the authoritative name server record returns NS_NOT_FOUND, indicating that conventional nameserver information is absent or concealed. Registration metadata shows the domain was provisioned through the Created App platform, a service often leveraged for rapid deployment of short‑lived web assets. The domain is actively listed on a single security blocklist and is explicitly blocked by the PhishDestroy filtering service, confirming that at least one downstream security product has taken mitigation action.

VirusTotal analysis reveals that one out of ninety‑one submitted security engines raised a detection, suggesting that at least one vendor has identified malicious behavior associated with the host. No additional public threat‑intel feeds such as OTX or Google Safe Browsing have published entries for this host, and no SSL/TLS certificate details, HTTP response codes, or page title information are available from the current dataset. The limited visibility into the web payload means the precise phishing lure and targeted brand remain unknown. However, the combination of a dedicated IP, opaque name server configuration, registration via a bulk‑creation service, and the presence on a commercial blocklist establishes a clear risk profile.

Defenders should continue to block the domain at network perimeters, monitor outbound DNS queries for the 216.150.1.1 address, and add the domain to internal allow‑list exclusions only after thorough verification. Threat‑hunting teams are advised to query endpoint telemetry for any recent connections to the domain or its resolved IP, and to correlate any credential‑theft alerts with this indicator. Ongoing observation is required, as the active status suggests the infrastructure may still be used for credential harvesting or further phishing campaigns.