bybit-op[.]com[.]cn

The domain bybit-op.com.cn was registered on April 07, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and remains active as of the report date. DNS resolution points to the IPv4 address 154.216.110.111, which is geolocated to Hong Kong and associated with Digital Core Technology Co., Limited. The authoritative nameservers are ns1.domainnamens.com and ns2.domainnamens.com. An HTTPS service is present, secured by a Let’s Encrypt R12 certificate, and the web server returns HTTP 200 for the root request. The page title returned by the server is a garbled string containing Chinese characters and the brand name Bybit, confirming the intent to impersonate the Bybit platform. The site is classified as a high‑risk brand impersonation campaign targeting Bybit users. It has been blocked by the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal reports that 2 of 94 scanned security vendors flagged the domain, and Gridinsoft assigns a trust score of 0 / 100, indicating a strong malicious profile. Current intelligence does not reveal the specific malicious payload or credential‑harvesting mechanisms employed, and the exact phishing kit used is not disclosed. Defenders should add bybit-op.com.cn to network and endpoint blocklists, monitor DNS queries for the domain and its nameservers, and consider sinkholing the resolved IP address to disrupt activity. Continuous observation of any changes to the SSL certificate, hosting provider, or registration details is recommended to detect potential infrastructure shifts.