main[.]d34szcsfxnagyb[.]amplifyapp[.]com

PhishDestroy has identified a brand impersonation campaign targeting the cryptocurrency exchange Bybit, hosted on the domain main.d34szcsfxnagyb.amplifyapp.com. The threat type is brand impersonation, specifically leveraging the Bybit name to deceive users. The page title observed was 'Anti-Money Laundering (AML) | Bybit Learn', suggesting a fake educational or compliance page designed to harvest credentials or personal information. No specific drainer kit was identified in the analysis.

Technical analysis reveals several key indicators. The domain resolves to IP address 99.86.4.52 and was created on April 17, 2018, giving it a relatively long history that may be used to appear legitimate. It is registered through NOM-IQ Ltd dba Com Laude. VirusTotal flagged the domain with a score of 1 out of 95 security vendors, placing it on 1 security blocklist. The SSL certificate is issued by Amazon RSA 2048 M01, confirming the hosting environment is Amazon Web Services. The domain was not found on Google Safe Browsing lists at the time of analysis.

As of the current report, the domain status is offline, indicating it has been taken down by the hosting provider or registrar. The remaining risk is low due to its offline status, but users who may have interacted with the page should monitor for signs of account compromise. PhishDestroy advises users to verify all communications from Bybit through official channels and never enter credentials or sensitive information on pages accessed via unsolicited links. For any suspected phishing activity, report it to the appropriate authorities or security teams.