# PhishDestroy threat dossier — bybit-us.net ================================================================ Fetched: 2026-06-25 18:31:16 UTC Canonical: https://phishdestroy.io/domain/bybit-us.net/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Bybit ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: Emsisoft, Fortinet, Netcraft, SOCRadar, Webroot Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.67.186.174 (US, San Francisco) Hosting org: AS13335 Cloudflare, Inc. Registrar: Cloudflare, Inc. Nameservers: coleman.ns.cloudflare.com, mckenzie.ns.cloudflare.com Registered: 2026-06-07 Expires: 2027-06-07 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-09-05 Status: INVALID chain Fingerprint: 185967692c2d6fd3e75f4b8a16c7440eae02fb37ed6e01de335e2127510dc714 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-07 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-25 02:46:08 UTC (by PhishDestroy tracker) Last verified: 2026-06-25 20:20:35 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019efc3c-1db5-714a-95d9-d399ba0d5be6/ Wayback Machine: https://web.archive.org/web/*/bybit-us.net crt.sh CT logs: https://crt.sh/?q=%25.bybit-us.net Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=bybit-us.net AlienVault OTX: https://otx.alienvault.com/indicator/domain/bybit-us.net URLhaus: https://urlhaus.abuse.ch/host/bybit-us.net/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 03:00:12 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain is flagged as an active crypto drainer brand impersonation campaign targeting users under the guise of a legitimate service provider. The domain impersonates a major trading platform to deceive users into connecting cryptocurrency wallets and initiating unauthorized fund transfers. Analysis indicates the threat actor leverages a spoofed interface to simulate wallet connectivity and transaction authorization screens, a characteristic technique of crypto drainer kits designed to extract private keys or approval signatures unnoticed. Infrastructure analysis reveals the domain resolves to IP address 172.67.186.174, hosted via Cloudflare, Inc. as the registrar. The domain was created on June 07, 2026, and currently exhibits a VirusTotal detection rate of 4 out of 95 security vendors, indicating limited but present visibility in threat intelligence feeds. No entry is recorded in Google Safe Browsing (GSB) at this time. Blocklist aggregation services report no active listings, though this may reflect latency in threat intelligence propagation. The domain remains active and is actively resolving, with no observed takedown or mitigation actions as of the latest scan. Given the low detection coverage and use of a reputable proxy service to obscure origin, the infrastructure poses a high risk to users who may interact with the site. Immediate network-level blocking of the domain and associated IP is recommended. Users should avoid interacting with any unsolicited links or advertisements referencing this domain. Security teams are advised to monitor for additional domains registered under similar patterns and to deploy behavioral detection rules targeting crypto wallet connection prompts. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 1f0f4935106a0a633e6439f675919100 TLS cert SHA-256: 185967692c2d6fd3e75f4b8a16c7440eae02fb37ed6e01de335e2127510dc714 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/bybit-us.net/ JSON API: https://api.destroy.tools/v1/check?domain=bybit-us.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 170,014 domains (14,703 alive under monitoring, 154,619 confirmed takedowns/dead). Site: https://phishdestroy.io