bybiti[.]com[.]cn

This domain, bybiti.com.cn, is flagged as a high-risk brand impersonation threat targeting the cryptocurrency exchange platform Bybit. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 07, 2026, the domain has been identified in 22 threat intelligence pulses on AlienVault OTX, indicating its involvement in multiple malicious campaigns. The page title, which contains a mix of English and non-standard characters (Bybit官网_Bybit交易所_Bybit下载_合约交易平台入口), suggests an attempt to deceive users by mimicking legitimate Bybit pages, potentially to harvest sensitive information or distribute malware. The domain is currently active and resolves to the IP address 154.216.106.249, which is not inherently associated with known malicious infrastructure but has been flagged by PhishDestroy and BLP-Malware, two reputable security blocklists. While the SSL certificate is provided by Let's Encrypt, a widely used and trusted certificate authority, this does not guarantee the domain's legitimacy, as it can be easily obtained by malicious actors. Analysts recommend that security teams and users remain vigilant and avoid interacting with this domain. Additional scrutiny, such as network monitoring and endpoint security measures, should be employed to detect and prevent any potential data breaches or malware infections. The low trust score of 0/100 from Gridinsoft further underscores the domain's malicious nature, and it is advisable to block access to bybiti.com.cn at the network level to mitigate the risk of exposure to this threat.