bybit-df[.]com[.]cn

bybit-df.com.cn is flagged as an active brand‑impersonation campaign targeting Bybit. The domain was registered on 7 April 2026 and resolves to the IPv4 address 154.216.110.104, which is geolocated to Hong Kong and associated with Digital Core Technology Co., Limited. DNS resolution uses the authoritative servers ns1.domainnamens.com and ns2.domainnamens.com. The site serves over HTTPS using a Let’s Encrypt R13 certificate, and HTTP requests return status 200. The page title observed is “Bybit官网_Bybit交易所_Bybit下载_合约交易平台入口”, which is consistent with a Bybit‑related phrase encoded in UTF‑8. Threat intelligence sources list the domain in a single AlienVault OTX pulse and on one external blocklist; PhishDestroy has actively blocked it. On VirusTotal, six of ninety‑four scanners flagged the domain, indicating modest detection. Gridinsoft assigns a trust score of 0 / 100, reinforcing its malicious classification. The evidence confirms a high‑risk impersonation operation, but detailed payload or credential‑harvesting mechanisms have not been publicly disclosed. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and consider adding the indicator to internal blocklists. Continued observation is advised to capture any evolution of the infrastructure or emergence of additional malicious payloads.