bybit-za[.]com[.]cn

This domain, bybit-za.com.cn, has been identified as a high‑risk impersonation of the Bybit brand. The site presents a Chinese‑language landing page titled "Bybit官网入口 - 新用户专享注册奖励 | 极速合约交易 2026", which mimics official Bybit promotional material and is likely intended to lure cryptocurrency users into registering and depositing funds under false pretenses. The infrastructure resolves to the IPv4 address 107.151.64.89, which maps to a Hong Kong data center operated by AS132839 POWER LINE DATACENTER. HTTP responses return status 200 and the server announces Nginx with HTTP/3 support, HSTS enforcement, and a TLS certificate issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 hierarchy. The domain is delegated to the public resolvers a4.share-dns.com and b4.share-dns.net and was registered through Web Commerce Communications Limited. Reputation analysis shows the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans flagged the domain by three of ninety‑five security engines, and the Gridinsoft trust score is 0 out of 100, indicating a lack of perceived legitimacy. The combination of a brand‑matching page title, cryptocurrency‑oriented wording, and a low trust score aligns with known cryptocurrency‑related impersonation campaigns that harvest credentials and funds. Defenders should add bybit-za.com.cn and its hosting IP 107.151.64.89 to deny‑list controls, monitor DNS queries for the associated nameservers, and enforce strict email and web filtering for communications that reference Bybit promotional offers. Incident response teams should treat any credential or wallet information submitted to this site as compromised and advise affected users to reset credentials and verify transaction histories. Ongoing analysis is needed to capture any downstream payloads or additional infrastructure that may be activated by the site.