bybit-9fv[.]pages[.]dev

This domain, bybit-9fv.pages.dev, is flagged as a high-risk brand impersonation site targeting Bybit, a cryptocurrency exchange. Registered on March 30, 2026, through Cloudflare, Inc., the domain remains active as of July 12, 2026, and resolves to the IP address 188.114.97.3, hosted in Canada under Cloudflare's infrastructure. The site is currently blocked by at least one security vendor (PhishDestroy) and appears on a single security blocklist. Infrastructure analysis reveals the use of Cloudflare nameservers (christian.ns.cloudflare.com and lara.ns.cloudflare.com), alongside technologies such as Ant Design, Vue.js, HSTS, and HTTP/3, which are consistent with modern web applications but do not inherently indicate malicious intent. The page title, 'Interactive brokers,' is inconsistent with the claimed Bybit impersonation, suggesting either a misconfiguration or an attempt to obfuscate the site's true purpose. The domain's Gridinsoft trust score of 0/100 further supports its classification as malicious. While VirusTotal indicates that one of 94 security vendors has flagged the domain, this limited detection does not provide conclusive evidence of widespread recognition. The SSL certificate, issued by Google Trust Services (WE1), is valid but does not mitigate the domain's fraudulent nature. Defenders should treat this domain as actively malicious, particularly in environments where Bybit or cryptocurrency-related services are accessed. Blocking the domain at the DNS or network level is recommended, along with monitoring for connections to the associated IP (188.114.97.3). Given the use of Cloudflare's infrastructure, additional scrutiny of other domains under the same nameservers or IP range may be warranted. The exact content and functionality of the site remain unanalyzed, but the available indicators align with typical brand impersonation tactics targeting financial or cryptocurrency platforms.