bybit-trc20[.]info

This domain is flagged as an elevated-risk brand impersonation threat targeting Bybit, a cryptocurrency exchange platform. Analysis indicates the site masquerades as an official Bybit Anti-Money Laundering (AML) verification portal, a tactic commonly employed to harvest user credentials, personal identification documents, and cryptocurrency wallet details. The page title 'Bybit AML' directly corroborates this impersonation strategy, designed to exploit users during compliance-related processes where heightened trust is assumed. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain bybit-trc20.info was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent domains. It resolves to the IP address 85.120.81.80, hosted by ALEXHOST SRL (AS200019) in Moldova, a jurisdiction with a documented history of hosting phishing infrastructure. The domain appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. Notably, the absence of an SSL certificate further undermines the site's legitimacy, as modern financial platforms universally enforce encrypted connections. The domain has since been taken offline, though historical resolution data confirms its prior operational status. Mitigation against such brand impersonation threats requires a multi-layered approach. Users should verify domain authenticity by cross-referencing official communications from the targeted brand, particularly for compliance-related requests such as AML verification. Organizations should implement domain monitoring to detect lookalike domains registered through high-risk registrars or hosted on suspicious autonomous systems. Network-level protections, such as blocking known malicious IPs (e.g., 85.120.81.80) and enforcing SSL requirements, can reduce exposure. Security teams are advised to update detection rules to include the domain's unique seed (1f538d) and associated indicators of compromise, while educating users on recognizing phishing tactics that exploit regulatory or compliance-themed pretexts.