bybitexchangecoin[.]com

Analysis conducted on July 23, 2026 identifies bybitexchangecoin.com as an offline domain used for brand impersonation of Bybit. The domain was registered on September 21, 2025 through GoDaddy.com, LLC and is hosted behind Cloudflare (AS13335). DNS resolution returns the IPv6 address 2a06:98c1:3120::3, which is geolocated to the United States. The domain employs a Google Trust Services certificate (WE1) and uses Cloudflare nameservers DAN.NS.CLOUDFLARE.COM and MAEVE.NS.CLOUDFLARE.COM. HTTP requests receive a 522 “Connection timed out” response, indicating that the web service is currently unavailable. Threat intelligence signals are consistent with a crypto‑scam profile.

The domain appears on one security blocklist and is specifically blocked by PhishDestroy. VirusTotal analysis shows that 16 of 93 security vendors have flagged the domain, and AlienVault OTX lists it in 15 separate threat pulses. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The page title returned by the server is “bybitexchangecoin.com | 522: Connection timed out”, confirming that the site is not serving content at the time of testing. The presence of Cloudflare infrastructure, a legitimate SSL certificate, and a reputable registrar are typical evasion techniques used to increase perceived legitimacy.

However, the combination of blocklist inclusion, multiple vendor detections, low trust score, and association with a known crypto‑scam brand suggests a high likelihood of malicious intent aimed at deceiving Bybit users. Uncertainty remains regarding the exact payload or phishing page that may have been hosted before the site was taken offline, as no visual or content analysis is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation, and add the IPv6 address to threat‑intel feeds.