bybitgloba1[.]xyz

PhishDestroy identifies bybitgloba1.xyz as an active brand impersonation domain targeting Bybit users. This fraudulent site (registered April 09, 2026 through NameSilo, LLC) resolves to IP 104.21.54.202 and has been confirmed by VirusTotal with only 1 out of 95 security vendors detecting it. While the domain holds a Google Trust Services SSL certificate, its recent creation and low detection rate suggest it is part of a coordinated impersonation campaign designed to deceive users into surrendering login credentials or financial information. The technical indicators associated with bybitgloba1.xyz reinforce its elevated threat profile. With a VirusTotal detection ratio of 1/95, this domain evades most automated security tools, increasing the risk of successful user compromise. The domain’s creation date (April 09, 2026) is suspiciously recent, indicating a likely “bulk-registered” campaign targeting the cryptocurrency exchange sector. Registrar data confirms use of NameSilo, LLC, a service known to provide anonymity and bulk registration options that facilitate fraudulent domain creation. The domain resolves to IP 104.21.54.202, which is shared across multiple low-reputation endpoints, further supporting its malicious classification. Users who visited bybitgloba1.xyz should immediately cease interaction and check for unauthorized transactions on any linked financial accounts. If credentials were entered, reset passwords immediately using an unrelated device and enable two-factor authentication on all accounts. Report the domain to Bybit’s phishing reporting channels and local cybercrime units. Avoid clicking links in unsolicited emails or messages referencing Bybit or similar platforms, and verify all URLs manually before interaction. This domain represents a clear brand impersonation threat and should be treated as hostile infrastructure.