hbybit[.]net

This domain, www.hbybit.net, is currently active and returns HTTP 200 responses. The site was registered on February 21, 2026 and is listed on a single security blocklist. PhishDestroy has already flagged the domain as malicious, and a Gridinsoft trust score of 0 out of 100 further indicates a high likelihood of abuse.

The host resolves to IP address 157.185.160.145, which is allocated to Meteverse Limited in the United States under ASN 54994. The domain is registered through Amazon Registrar, Inc., and uses four Amazon‑provided name servers (ns-1206.awsdns-22.org, ns-1782.awsdns-30.co.uk, ns-285.awsdns-35.com, and one truncated entry). TLS is provided by a TrustAsia DV TLS RSA CA 2025 certificate, confirming that encrypted connections are available but do not guarantee legitimacy.

Technical fingerprints show a modern web stack: the front‑end is built with React and the hosting appears to rely on Amazon Web Services. Multiple third‑party tracking tags are present, including Yandex.Metrika, Twitter Ads, Naver Analytics, MGID, and LinkedIn Insight and Ads tags, suggesting attempts to gather visitor data. The page title reported as “Buy” aligns with the declared cryptocurrency scam type and the explicit claim that the site impersonates the Bybit brand. VirusTotal scans have flagged the domain by 11 of 95 security vendors, reinforcing the suspicion raised by the low trust score and blocklist presence.

Defenders should treat www.hbybit.net as a high‑risk brand‑impersonation threat. Immediate actions include adding the domain to network and email blocklists, monitoring DNS queries for the listed name servers, and, where possible, sinkholing the resolved IP address. Continuous re‑evaluation is advised, as the site’s content has not been publicly examined beyond the title, and further malicious payloads could be deployed behind the existing infrastructure.