bybitwallet-audit[.]com

This domain, bybitwallet-audit.com, is identified as a brand impersonation phishing infrastructure targeting Bybit, a cryptocurrency exchange and wallet service. The domain is currently offline, though it previously hosted content designed to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. Analysis indicates the site was engineered to mimic legitimate Bybit audit or verification processes, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 29, 2026, and resolved to the IP address 2.27.33.89. The site was flagged by 15 of 95 security vendors on VirusTotal, and appears on three independent security blocklists. Additional technical indicators include the use of Google Web Server, HTTP/3, and HTTP Strict Transport Security (HSTS), alongside a page title of 'Google,' which may have been employed to evade detection or mislead automated scanning tools. The domain holds a Gridinsoft trust score of 0 out of 100, further corroborating its malicious classification. The domain has since been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter, and to monitor for unauthorized access or transactions linked to Bybit accounts. End users should be alerted to verify domain authenticity before entering credentials, particularly when prompted by unsolicited audit or verification requests. Security teams are encouraged to review logs for connections to 2.27.33.89 and to correlate any findings with known phishing indicators.