bybit-sc[.]com[.]cn

PhishDestroy identifies an active brand impersonation campaign targeting Bybit users through the domain bybit-sc.com.cn. This fraudulent site poses a significant risk to cryptocurrency holders by mimicking the legitimate Bybit exchange (bybit.com) to deceive victims into entering sensitive credentials or transferring funds. The domain was registered recently and remains undetected by most antivirus engines, making it a stealthy threat to unsuspecting users. This domain was flagged by PhishDestroy with critical indicators including 0 detections out of 95 VirusTotal scans, a low-risk assessment due to its recent activity, and a connection to IP address 154.216.119.19. The site uses a Let’s Encrypt SSL certificate to appear legitimate, a common tactic among fraudulent sites to gain user trust. The domain bybit-sc.com.cn was registered via an anonymized registrar and shows no prior reputation, suggesting it was created specifically for this campaign. If you visited bybit-sc.com.cn, do not enter any login credentials, wallet addresses, or personal information. Disconnect from the site immediately and scan your device for malware using updated antivirus software. Report the domain to Bybit’s official security channels and warn others in your network. If you submitted sensitive data, assume compromise: revoke API keys, change passwords, and monitor your accounts for unauthorized transactions. Avoid clicking links from unsolicited emails or messages claiming to be from Bybit.