bybit-mn[.]com[.]cn

This domain, bybit-mn.com.cn, is actively impersonating the Bybit cryptocurrency exchange platform as of July 12, 2026. Registered on March 5, 2026, through Web Commerce Communications Limited, the site presents itself as the official Bybit trading platform with the page title 'Bybit交易所官网 - 注册开户立即领取福利 | 全球顶级衍生品平台 2026.' The domain resolves to IP address 107.151.64.88 and employs Nginx as its web server, along with HSTS and HTTP/3 protocols, which may attempt to lend an appearance of legitimacy or security. Analysis indicates the domain has been flagged by 8 out of 95 security vendors on VirusTotal, with 23 threat intelligence pulses recorded in AlienVault OTX. It also appears on two security blocklists and is currently blocked by at least two threat intelligence platforms. The trust score assigned by Gridinsoft is 0 out of 100, further corroborating its malicious classification. The domain remains active, with no indication of takedown efforts as of the report date. The primary uncertainty lies in the specific payload or attack vector being employed, as the available intelligence does not detail whether the site distributes malware, harvests credentials, or facilitates fraudulent transactions. However, the combination of brand impersonation, recent registration, and low trust scores strongly suggests malicious intent. Defenders should treat this domain as a high-risk threat and prioritize blocking it at the DNS or network level. Security teams are advised to monitor for any connections to 107.151.64.88 and review logs for interactions with bybit-mn.com.cn, particularly from users who may have engaged with the site under the false pretense of accessing Bybit services.