# PhishDestroy threat dossier — bybit-up.com ================================================================ Fetched: 2026-05-07 08:13:18 UTC Canonical: https://phishdestroy.io/domain/bybit-up.com/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 51/100 (PhishDestroy scoring — see methodology below) Targeted brand: Bybit ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/95 security vendors flagged this domain Flagging vendors: Emsisoft, Fortinet, Netcraft, Webroot URLQuery: 2 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 34.124.210.152 (SG, Singapore) ASN: AS396982 Google LLC Hosting org: Google Cloud (asia-southeast1) Registrar: Gname.com Pte. Ltd. Nameservers: a.share-dns.com, a1.share-dns.com, b.share-dns.net, b1.share-dns.net Registered: 2026-04-29 Page title: Buy & Sell Bitcoin, Ether | Cryptocurrency Exchange | Bybit HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-29 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-07 09:15:48 UTC (by PhishDestroy tracker) First reported: 2026-05-07 06:16:02 UTC (abuse notice filed) Last verified: 2026-05-07 10:47:08 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e0112-9e47-7048-b492-87f354acbd28/ URLQuery: https://urlquery.net/report/25504710-2baf-4aea-9c07-20799180bd4b Wayback Machine: https://web.archive.org/web/*/bybit-up.com crt.sh CT logs: https://crt.sh/?q=%25.bybit-up.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=bybit-up.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/bybit-up.com URLhaus: https://urlhaus.abuse.ch/host/bybit-up.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-07 09:16:49 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Domain bybit-up.com was detected as a malicious site impersonating the popular cryptocurrency exchange Bybit, posing a significant risk to unsuspecting users. This site likely attempts to mimic Bybit's official platforms to trick visitors into entering sensitive credentials or transferring cryptocurrency to attacker-controlled wallets. Brand impersonation in the crypto space is frequently used by threat actors to capitalize on trust in well-known platforms, especially during periods of high market activity. By replicating the legitimate site's design and branding, attackers aim to deceive users into unknowingly exposing their private keys, login details, or initiating unauthorized transactions. This domain was flagged based on multiple indicators of compromise. VirusTotal analysis reveals that 4 out of 95 security vendors have already identified this domain as malicious, highlighting its suspicious nature. The domain was registered through Gname.com Pte. Ltd. on April 29, 2026, a relatively recent creation that aligns with the tactics of opportunistic threat actors leveraging newly registered domains for short-lived campaigns. Further scrutiny reveals the domain resolves to the IP address 34.124.210.152 and utilizes a valid Let's Encrypt SSL certificate, measures often employed to appear legitimate and evade basic security checks by unsuspecting users. The combination of these factors elevates the risk level, as the domain demonstrates clear intent to deceive visitors by impersonating a trusted brand in the cryptocurrency ecosystem. If you have visited bybit-up.com, disconnect from the internet immediately and run a full antivirus scan on your device. Avoid entering any login credentials, private keys, or sensitive information on the site. If you provided any details, change your passwords immediately on the official Bybit platform and enable two-factor authentication if not already activated. Report the domain to your security team or platform administrators to ensure others are protected from similar threats. Always verify the authenticity of websites by checking the official domain (bybit.com) and ensuring secure HTTPS connections with valid certificates. When in doubt, navigate directly to the legitimate platform's official website rather than clicking on unverified links. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260507-0FE27D Favicon MD5: 00ae6ca149472387f9c07918cab3a006 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/bybit-up.com/ JSON API: https://api.destroy.tools/v1/check?domain=bybit-up.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 146,790 domains (58,432 alive under monitoring, 88,097 confirmed takedowns/dead). Site: https://phishdestroy.io