# excbybit.com — SUSPICIOUS

> excbybit.com impersonated Bybit in a low-risk phishing attempt and is now offline. Stay vigilant and avoid this domain to protect your credentials.

## Summary
PhishDestroy identifies excbybit.com as a brand impersonation domain targeting Bybit, a well-known cryptocurrency exchange. The site was used to mimic Bybit’s platform, potentially aiming to deceive users into divulging sensitive information. Despite its intent, the risk level associated with excbybit.com has been assessed as low, possibly due to limited operation or scope. The page title detected was "COINVOYAGES," which may have been used to further confuse visitors or divert attention from the genuine Bybit brand.

The domain excbybit.com was registered on March 4, 2026, through NameSilo, LLC, and currently resolves to the IP address 172.67.213.97. Technical analysis shows the domain appeared on three security blocklists, while VirusTotal scans flagged suspicions from only two of 95 security vendors, indicating minimal detection in automated defenses. These factors, combined with the domain’s current offline status, suggest it was either taken down preemptively or failed to sustain malicious activities over time.

At present, excbybit.com remains offline and inaccessible, removing immediate risk from users. PhishDestroy recommends users remain cautious and avoid interacting with suspicious domains, especially those closely resembling reputable brands like Bybit. Organizations should continue monitoring for similar impersonation attempts and educate users on recognizing phishing indicators. Maintaining awareness and verifying URLs remain critical steps to safeguard personal and financial information from such low-level threats.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Target brand: Bybit
- Page title: COINVOYAGES

## Domain Intelligence
- Registered: 2026-03-04 15:07:01
- Registrar: NameSilo, LLC
- Country: US
- IP: 172.67.213.97
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: chin.ns.cloudflare.com margo.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["SOCRadar", "Trustwave"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://i.ibb.co/SDH2kt7Z/eff51f1943b5.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/excbybit.com
- PhishDestroy: https://phishdestroy.io/domain/excbybit.com/
- LLM endpoint: https://phishdestroy.io/domain/excbybit.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/excbybit.com/
Last updated: 2026-03-19