bybittr5678[.]vip

This domain, bybittr5678.vip, is flagged as an active brand impersonation campaign targeting the cryptocurrency exchange Bybit. The domain was created on August 18, 2025, and remains operational as of July 12, 2026. It is registered through Gname.com Pte. Ltd., a registrar known for hosting deceptive domains. The domain resolves to IP address 104.21.32.1, which is located in the United States and belongs to AS13335 Cloudflare, Inc. Infrastructure analysis reveals that the domain uses Cloudflare nameservers (bailey.ns.cloudflare.com and cory.ns.cloudflare.com), employs HTTP/3, and has an SSL certificate issued by Google Trust Services WE1. The page title is recorded as 'APP' and the HTTP status returned is 200, indicating the site is live and serving content. The domain appears on one security blocklist, PhishDestroy, and VirusTotal reports 2 out of 95 security vendors flagging it as malicious. The Gridinsoft trust score is 0 out of 100, strongly suggesting a deceptive intent. What remains uncertain is the exact nature of the content served on the site, as the page title 'APP' provides minimal detail. It is not confirmed whether the site hosts a login form, a fake download page, or another type of credential harvesting mechanism. The brand target, Bybit, is clearly identified in the intelligence, but the absence of a specific phishing kit detection or detailed page description leaves some ambiguity about the technical implementation. Defenders should treat this domain as a confirmed threat. It is recommended to block the domain at the DNS level, add the IP address 104.21.32.1 to threat intelligence feeds, and monitor for any related subdomains or lookalike registrations. Users should be warned not to visit the site or provide any personal or financial information. The use of Cloudflare infrastructure may complicate takedown efforts, so coordination with the hosting provider and registrar should be initiated promptly.