bybit-hj[.]com[.]cn

The domain bybit-hj.com.cn has been identified as a brand impersonation threat targeting Bybit, a prominent cryptocurrency exchange. This domain was crafted to deceive users into believing they are interacting with legitimate Bybit services, potentially leading to credential theft or financial loss. According to available intelligence, the domain was created on April 07, 2026, and its page title displayed a mix of Chinese characters referencing Bybit's official site, exchange, and contract trading platform, further supporting the impersonation narrative.

From a technical standpoint, VirusTotal flagged bybit-hj.com.cn with a score of 2 out of 95 security vendors, indicating moderate but not overwhelming detection. The domain resolves to IP address 154.216.110.102 and uses an SSL certificate issued by Let's Encrypt / R13, which is commonly abused by malicious actors due to its free and automated nature. Additionally, the domain appears on one security blocklist and is listed in one AlienVault OTX threat intelligence pulse, suggesting it has been observed in broader threat campaigns. Google Safe Browsing status was not explicitly mentioned but the domain's current status is reported as offline.

As of the latest analysis, bybit-hj.com.cn has been taken offline, reducing immediate risk. However, the domain's presence on blocklists and its targeted impersonation of a major brand like Bybit warrant continued monitoring. Users and organizations should implement preventive measures such as blocking the domain at the network level, educating employees about brand impersonation tactics, and verifying the legitimacy of Bybit-related communications. Even after takedown, similar domains may emerge, so staying vigilant and leveraging threat intelligence feeds is recommended to mitigate future risks.