bybitcoin[.]cc

Analysis of the domain bybitcoin.cc indicates it was actively impersonating the Bybit cryptocurrency exchange platform, classified as a high-risk crypto scam. The domain was registered on September 5, 2025, through Gname.com Pte. Ltd., with a single nameserver configured. Infrastructure analysis reveals it resolved to the IP address 151.242.20.56, hosted by OWGELS INTERNATIONAL CO., LIMITED (AS153656) in Hong Kong. No SSL certificate was detected, increasing the likelihood of unencrypted user data transmission. The page title 'PNCEX' does not match the expected Bybit branding, suggesting either a misconfiguration or an attempt to obscure the site's true purpose.

Detection data shows the domain appeared on one security blocklist (PhishDestroy) and was flagged by Google Safe Browsing for social engineering. VirusTotal reports 11 of 95 security vendors marked it as malicious, while AlienVault OTX included it in one threat intelligence pulse. Trust scores from Scamadviser (15/100) and Gridinsoft (0/100) further corroborate its classification as fraudulent. As of the report date, the domain is offline, though its prior infrastructure remains documented in threat intelligence sources.

Defenders should treat this domain as confirmed malicious infrastructure associated with crypto fraud. While the exact scam mechanics (e.g., credential harvesting, fake token sales, or wallet drainers) are not specified in available data, the combination of brand impersonation, low trust scores, and detection by multiple security vendors justifies blocking access. Network defenders are advised to monitor for related domains registered through the same registrar or resolving to the same IP range, particularly those targeting cryptocurrency users. The absence of an SSL certificate and the use of a single nameserver may serve as additional indicators of compromise for automated detection systems.