bybit[.]internalpayservice[.]com

The domain bybit.internalpayservice.com was registered through Dynadot LLC on 21 February 2026 and resolves to the IPv4 address 198.251.89.220, which is announced by AS53667 FranTech Solutions and geolocated to the United States. The authoritative name servers are ns27.asurahosting.com and ns28.asurahosting.com. The site presents a page titled “How Does Bybit Internal Pay Service Work? | Bybit Blog”, which aligns with a brand‑impersonation campaign targeting Bybit users. Security telemetry shows the domain is classified as a crypto‑scam and has been blocked by PhishDestroy; it also appears on a single external blocklist.

VirusTotal scans have returned 6 detections out of 95 AV engines, indicating partial consensus among vendors that the domain is malicious. The web server employs LiteSpeed, the Smartsupp chat widget, and supports HTTP/3. An SSL certificate identified as “R12” is present, but the certificate details have not been released publicly. As of the report date (24 July 2026) the site is taken offline, which may be temporary or a takedown response. Current analysis confirms that the domain mimics official Bybit branding in its title and likely aims to harvest cryptocurrency credentials or payments, but the exact payload or credential‑capture mechanism has not been observed.

Investigators lack access to the full page content and any associated phishing forms, so the full attack vector remains uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP address and name server infrastructure for any re‑activation, and add the domain to internal threat‑intel feeds. Additional scrutiny of traffic to 198.251.89.220, especially HTTP/3 connections using LiteSpeed, is advised. Organizations using Bybit services should alert users to the existence of this impersonation attempt and reinforce legitimate communication channels.