bybit-us[.]net

This domain is flagged as an active crypto drainer brand impersonation campaign targeting users under the guise of a legitimate service provider. The domain impersonates a major trading platform to deceive users into connecting cryptocurrency wallets and initiating unauthorized fund transfers. Analysis indicates the threat actor leverages a spoofed interface to simulate wallet connectivity and transaction authorization screens, a characteristic technique of crypto drainer kits designed to extract private keys or approval signatures unnoticed.

Infrastructure analysis reveals the domain resolves to IP address 172.67.186.174, hosted via Cloudflare, Inc. as the registrar. The domain was created on June 07, 2026, and currently exhibits a VirusTotal detection rate of 4 out of 95 security vendors, indicating limited but present visibility in threat intelligence feeds. No entry is recorded in Google Safe Browsing (GSB) at this time. Blocklist aggregation services report no active listings, though this may reflect latency in threat intelligence propagation.

The domain remains active and is actively resolving, with no observed takedown or mitigation actions as of the latest scan. Given the low detection coverage and use of a reputable proxy service to obscure origin, the infrastructure poses a high risk to users who may interact with the site. Immediate network-level blocking of the domain and associated IP is recommended. Users should avoid interacting with any unsolicited links or advertisements referencing this domain. Security teams are advised to monitor for additional domains registered under similar patterns and to deploy behavioral detection rules targeting crypto wallet connection prompts.