bybita[.]apexciti[.]com

The domain bybita.apexciti.com was registered on February 21, 2026 through EuropeanConnectionOnline.com LLC. It resolves to the IPv4 address 198.12.66.123, which is announced by AS36352 (HostPapa) and geolocated to the United States. The site is currently classified as active with a high risk rating.

Infrastructure analysis shows the domain uses the public nameservers ns1.afternic.com and ns2.afternic.com, with an additional verification nameserver entry (verification-d3jclucsp89ganyqbydeny.ns). The TLS certificate presented is identified as R11 and the HTTP response returns status code 200, indicating a reachable web service. VirusTotal scans have flagged the domain in 3 of 95 security vendors, and the host appears on a single security blocklist. The site is also listed as blocked by PhishDestroy.

The page title reported is "Welcome | Bybita", and the domain explicitly impersonates the cryptocurrency exchange Bybit. The scam type is identified as cryptocurrency, suggesting attempts to lure victims into financial fraud. No further content analysis has been performed, so the exact phishing workflow, credential collection mechanisms, or malicious payloads remain unknown.

Given the confirmed brand impersonation and the hosting characteristics, defenders should add bybita.apexciti.com to domain deny lists, enforce DNS sinkholing, and monitor outbound connections to the associated IP. Continuous re‑evaluation of VirusTotal and other threat feeds is advised, as additional detections may emerge. Network sensors should flag any HTTP 200 responses from this host, and user‑facing security awareness programs should highlight the Bybit impersonation attempt.