bybitfx[.]io

This domain, bybitfx.io, is identified as a brand impersonation phishing site targeting Bybit, a cryptocurrency exchange platform. The threat type is classified as brand impersonation, designed to deceive users into believing they are interacting with legitimate Bybit services. As of the latest analysis, the domain is offline, though it previously hosted content mimicking the official Bybit trading interface. Infrastructure analysis reveals that bybitfx.io resolved to the IP address 114.207.245.211 and was registered through Whois Corp on May 07, 2026. Detection metrics indicate that 2 of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist, and its Gridinsoft trust score is 0 out of 100, further confirming its suspicious nature. Technologies detected on the site include PHP, Tailwind CSS, OpenSSL, Apache HTTP Server, and jQuery, which are commonly used in both legitimate and malicious web applications. The page title, 'The Future of Trading | BybitFX,' closely resembles branding associated with the targeted platform. Given the domain's current offline status, immediate risk to end users is reduced. However, organizations and individuals should remain vigilant, as infrastructure associated with such campaigns may be reactivated or repurposed. It is recommended to block the domain and its associated IP address (114.207.245.211) at the network level. Users who may have interacted with this domain should verify account integrity, monitor for unauthorized transactions, and reset credentials for any associated services. Security teams are advised to review logs for connections to the identified IP and domain to assess potential exposure.