bybita[.]org

PhishDestroy identifies bybita.org as a high-risk brand impersonation phishing domain actively impersonating the legitimate cryptocurrency exchange Bybit. This domain uses a deceptive visual design and a misleading page title, ‘Welcome | Bybita’, to trick users into believing they are interacting with the official Bybit platform. Once on the site, victims may be prompted to enter sensitive credentials or cryptocurrency wallet information, which are then harvested by attackers for financial theft or further fraud. The threat is compounded by the domain’s recent registration—just days ago on June 14, 2025—indicating a fast-moving operation designed to exploit trust in well-known brands before detection systems catch up. This domain was flagged by PhishDestroy after being detected by only 2 out of 95 security vendors on VirusTotal, demonstrating the difficulty of detection via automated scanning alone. It was registered through Atak Domain Bilgi Teknolojileri A.Ş., a Turkish registrar, and is currently resolving to IP address 146.71.81.220. Despite the low detection rate, the presence of a Let's Encrypt SSL certificate suggests an attempt to appear legitimate. The combination of a newly registered domain, low blocklist coverage, and a targeted brand spoofing campaign elevates the risk and urgency for users to avoid interaction. If you have visited bybita.org or entered any information, immediately cease use of the site and revoke any shared credentials. Use a clean device to change passwords on all accounts, especially those related to cryptocurrency or financial services. Report the domain to your security team or through PhishDestroy’s reporting system. Avoid clicking on any links from emails or messages related to this domain, and consider using a DNS blocklist that includes this IP and domain to prevent future exposure. Stay vigilant: newly registered domains mimicking trusted brands are a common vector for credential theft and financial fraud.