bybitgum[.]org

The domain bybitgum.org was identified as a brand‑impersonation site targeting Bybit. The site’s page title reads "Buy & Sell Bitcoin, Ether | Cryptocurrency Exchange | Bybit," directly copying Bybit’s marketing phrasing. The domain is currently offline and has been taken down by the PhishDestroy takedown service. The site was classified as a Crypto Scam and explicitly impersonates the Bybit brand. Infrastructure analysis shows the domain resolves to the IPv6 address 2600:141b:1c00:2e::17d1:48ca, which belongs to AS20940 Akamai International B.V. in the United States, indicating the use of a major CDN for hosting.

No SSL certificate was observed, meaning the site did not offer HTTPS protection. The domain was registered on April 8, 2021 through CSC Corporate Domains, Inc., and it uses a single nameserver, suggesting a simple DNS configuration. VirusTotal records show that five of ninety‑five security vendors flagged the domain as malicious, providing independent corroboration of its abusive nature. The domain appears on one security blocklist, and the blocklist entry is publicly referenced by PhishDestroy. Defenders should immediately add bybitgum.org to DNS‑level blocklists and firewall deny lists, and monitor outbound connections to its resolved IP address, especially the IPv6 range associated with Akamai.

Endpoint detection platforms should be tuned to raise alerts on any process attempting to contact the domain or its IP, regardless of protocol. Security teams should also enrich their threat feeds with the registrar (CSC Corporate Domains, Inc.) and the ASN (AS20940) to detect future registrations that may reuse the same infrastructure. User education campaigns should warn employees about unsolicited messages referencing Bybit that direct to unknown URLs, emphasizing verification of the domain’s TLS status.