bybit-ml[.]xyz

This domain bybit-ml.xyz was registered on February 25, 2026 through Gname.com Pte. Ltd. and resolves to IP address 160.124.210.246. The page title references Bybit exchange services with promotional registration offers, establishing direct brand impersonation of the targeted cryptocurrency platform. Detection data shows VirusTotal flags from 13 out of 95 vendors, a Gridinsoft trust score of zero out of one hundred, presence on two security blocklists, and inclusion in 23 AlienVault OTX pulses. The domain remains active with a high-risk classification tied specifically to brand impersonation.

Infrastructure analysis reveals an SSL certificate issued by Let's Encrypt, Nginx web server software, and protocol support for HSTS along with HTTP/3. These elements are consistent with standard hosting configurations that can support persistent malicious operations. Blocks recorded by PhishDestroy and BLP-Malware add independent confirmation of abuse. The combination of registration details, explicit title content, and aggregated detections indicates coordinated impersonation activity rather than incidental or benign use of the domain name.

Uncertainty exists around the exact downstream actions performed once visitors reach the site, including whether credential harvesting forms or further redirects are deployed. No additional kit signatures or ASN-level details are available to narrow the operational picture beyond the recorded indicators. The creation date of February 25, 2026 places the domain within a normal timeframe relative to the current date of July 12, 2026.

Defenders should incorporate the domain and its resolving IP 160.124.210.246 into blocklists and monitoring rules. Cross-referencing against updated threat feeds that already contain the domain in multiple pulses supports proactive blocking. Continued observation of the same infrastructure for newly registered similar names can help limit further impersonation attempts against the same brand.