xn--bybt-spa[.]app

This domain presents an elevated risk to cryptocurrency investors due to its targeted brand impersonation of Bybit, a leading crypto exchange. PhishDestroy has identified xn--bybt-spa.app as a sophisticated phishing attempt designed to steal wallet credentials by masquerading as the legitimate 'Bybit wallet' service. The threat level is elevated because the domain was registered specifically to deceive Bybit users, and while it is currently offline, similar domains may still be active.

Technical indicators paint a clear picture of malicious intent. VirusTotal data shows that 5 out of 95 security vendors flagged this domain, and it appears on three independent security blocklists. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to IP address 146.19.128.37 with no SSL certificate, which is unusual for any legitimate financial service. These factors, combined with the use of an internationalized domain name (IDN) to visually mimic 'bybit', confirm the phishing nature of this operation. The unique seed c8176e was used to generate this report, ensuring traceability.

To protect against Bybit wallet phishing, users should always verify the URL before entering credentials, ensure the site uses HTTPS with a valid certificate, and enable two-factor authentication on their Bybit account. If you have already interacted with this domain, change your Bybit password immediately and contact Bybit support. Additionally, report any suspicious domains to PhishDestroy and security blocklists to prevent further victimization.