bybitdex[.]network

bybitdex.network is currently active and classified as a high‑risk brand‑impersonation site targeting the cryptocurrency exchange Bybit. The page title observed for the domain reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | YukiTale,” which does not directly reference Bybit but indicates a cryptocurrency‑focused offering. The site is listed on a single security blocklist and has been blocked by PhishDestroy, confirming that it is being actively monitored by defensive feeds. Technical investigation shows that the domain is hosted behind Cloudflare’s network. It resolves to the IP address 104.21.68.87, which belongs to AS13335, Cloudflare, Inc., and is geo‑located in the United States. The authoritative nameservers are ashton.ns.cloudflare.com and tina.ns.cloudflare.com, and the domain registration is also performed through Cloudflare, Inc. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid‑looking HTTPS connection. The service uses Cloudflare’s HTTP/3 protocol, and the HTTP response code is 200. VirusTotal has flagged the domain on 13 of 95 scanning engines, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Defenders should treat any traffic to bybitdex.network as malicious and block it at network perimeters. Correlation with the observed page title and the Bybit brand target suggests that credential‑theft or fund‑exfiltration attempts may be attempted against Bybit users. Organizations employing web filtering or DNS sink‑hole solutions should add the domain to block lists, and incident response teams should monitor for related indicators such as the IP address 104.21.68.87 and the associated Cloudflare nameservers. Continuous monitoring of threat feeds for new detections is advised, given the active status of the infrastructure.