bybit-aml[.]help

The domain bybit-aml.help was registered on September 08, 2025 through Web Commerce Communications Limited and uses the LuxHost name servers ns1.luxhost.org and ns2.luxhost.org. DNS resolution points to IP address 185.242.245.62, which belongs to AS214927 (PSB HOSTING LTD) located in the Netherlands. No SSL certificate is presented, indicating the site was served over plain HTTP. The HTTP response has been taken offline, and the domain is currently listed as offline in threat feeds. The page title returned from the site is “Bybit Audit”, and the brand target is explicitly listed as Bybit.

The scam classification is recorded as wallet/seed phishing, suggesting the operator intended to harvest cryptocurrency wallet credentials or seed phrases. The domain appears on a single security blocklist and has been flagged by PhishDestroy. VirusTotal analysis shows that four out of ninety‑five scanning engines identified malicious characteristics, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. Evidence indicates that the infrastructure is typical of short‑lived impersonation campaigns: a recent registration date, a disposable hosting provider, and the absence of TLS.

However, the limited number of blocklist entries and the modest VirusTotal detection count leave some uncertainty about the scale of distribution or any active payload. No additional indicators such as known phishing kits, command‑and‑control endpoints, or malware hashes are publicly disclosed. Defenders should add bybit-aml.help to URL filtering and DNS‑based blocklists, monitor the associated IP range 185.242.245.62 for any future activity, and enforce TLS‑only policies to prevent accidental connections to unsecured domains. Users of the Bybit platform should be warned that any request for audit information or seed phrases originating from this domain is illegitimate.