bybit[.]brandresults[.]com[.]au

bybit.brandresults.com.au was registered through Domain Directors Pty Ltd trading as Instra. The authoritative nameservers are ns1.servepoint.com.au and ns2.servepoint.com.au, and DNS resolution points to IP address 27.50.75.67, which belongs to AS45671 Wholesale Services Provider in Australia. No TLS certificate is presented for the host, indicating that the site is served over plain HTTP. Reputation services assign a Scamadviser trust score of 1 out of 100, reflecting an extremely low confidence level. The page title returned by the server is “Log In | Bybit”, matching the declared brand target Bybit and confirming a brand‑impersonation intent.

VirusTotal analysis shows that fourteen of ninety‑five scanned security vendors flagged the domain as malicious, reinforcing the suspicion. The domain appears on a single public security blocklist and has been actively blocked by the PhishDestroy feed. The site’s current operational status is offline, and it is listed as an elevated‑risk crypto‑scam in the intelligence. From the observable data, the infrastructure is modest, using a generic Australian hosting provider and standard ServePoint nameservers, which are commonly abused by low‑volume phishing campaigns. The absence of SSL, combined with the low trust score and multiple vendor detections, suggests the domain was employed to harvest credentials for the Bybit platform.

However, the precise phishing kit, hosting platform, and any associated command‑and‑control infrastructure remain unknown because no further payload or network traffic has been captured. Defenders should add 27.50.75.67 and bybit.brandresults.com.au to DNS‑based and proxy blocklists, enforce HTTPS‑only policies where possible, and monitor for any outbound connections to the identified IP range. Because the domain is already offline, incident response teams can use the registration and nameserver details to request takedown actions from the registrar and hosting provider.