bybit-listing[.]vote

PhishDestroy identifies a brand impersonation phishing campaign targeting Bybit users through the domain bybit-listing.vote. This fraudulent site masquerades as the legitimate Bybit exchange platform to deceive victims into entering credentials or cryptocurrency deposits. The domain was registered on April 30, 2026, through Dynadot Inc and is currently active, with a Let's Encrypt SSL certificate to appear trustworthy. Security blocklists have flagged it twice, though VirusTotal currently shows 0 out of 95 engines detecting it, highlighting a potential detection gap that threat actors may exploit before broader recognition occurs. This domain poses a high-risk threat to Bybit users due to its active status and deliberate imitation of the brand's official communications, such as listing announcements. The domain resolves to IP address 172.67.151.67 and is already blocked by MetaMask and SEAL, indicating proactive security measures are in place. However, its recent registration date and low detection rate on VirusTotal suggest it may still be in early operational phases, targeting unsuspecting users who may not cross-reference domains with official Bybit channels. If you have visited bybit-listing.vote or entered any information, immediately revoke any shared credentials, transfer any deposited cryptocurrency to a cold wallet, and scan your device for malware. Report the domain to Bybit's official support and update your security tools with the latest threat intelligence. Avoid clicking links from unsolicited emails or social media messages claiming to originate from Bybit, and always verify domain names against official sources before interacting.