bybit[.]airdropfamilyidn[.]com

Analysis of the domain bybit.airdropfamilyidn.com indicates a targeted brand impersonation campaign designed to deceive users through a fraudulent airdrop scheme. The domain was registered on February 21, 2026, via registrar CV. Jogjacamp, a provider previously associated with high-risk domains. Infrastructure analysis reveals resolution to the IP address 23.207.201.201, geolocated in Germany and assigned to AS20940 (Akamai International B.V.), a network frequently utilized for both legitimate and malicious activities.

Nameservers exp1.liqu.id and exp2.liqu.id further suggest a pattern consistent with domains involved in phishing operations. Detection data shows limited but notable coverage: the domain appears on a single security blocklist (PhishDestroy) and was flagged by one of ninety-three security vendors on VirusTotal. The SSL certificate, identified as R12, provides no additional trust indicators, aligning with common phishing infrastructure characteristics. The page title, 'Token Splash,' corroborates the scam type specified in available intelligence—fake airdrop—though no further content analysis has been conducted to confirm on-page elements or functionality.

At the time of this report, the domain has been taken offline, though its prior hosting and registration details remain relevant for defensive monitoring. Defenders are advised to treat this domain as part of a broader pattern of Bybit-branded phishing activity, particularly given the use of a subdomain structure ('airdropfamilyidn') designed to exploit user trust in promotional events. While detection coverage is currently low, the combination of registrar reputation, hosting provider, and scam classification warrants elevated scrutiny. No evidence links this domain to additional threat actors or campaigns beyond the specified fake airdrop classification.