learn[.]hbybit[.]net

Analysis of the domain learn.hbybit.net indicates active brand impersonation targeting Bybit, a cryptocurrency exchange. The domain was registered on January 25, 2025, through Amazon Registrar, Inc., and resolves to the IP address 157.185.160.145, hosted under AS54994 (Meteverse Limited) in the United States. Infrastructure analysis reveals the use of Amazon Web Services, Nginx, and OpenResty, alongside technologies such as Google Sign-in, React, and Akamai, which may facilitate credential harvesting or fraudulent transactions. The SSL certificate is issued by TrustAsia Technologies, Inc., a common provider for both legitimate and malicious domains. The page title, 'Learn All About Cryptocurrency | Bybit Learn,' explicitly mimics Bybit’s educational content, reinforcing the brand impersonation classification. Detection data shows the domain is flagged by 16 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on two security blocklists, including PhishDestroy and PhishingDB, and currently returns an HTTP 403 status, which may indicate evasion tactics or restricted access. While the exact content of the site remains unconfirmed due to the 403 response, the combination of brand impersonation, cryptocurrency-themed page title, and detection by multiple security vendors strongly suggests malicious intent. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to it. Further investigation into associated infrastructure, such as nameservers (ns-1206.awsdns-22.org, ns-1782.awsdns-30.co.uk, ns-285.awsdns-35.com, ns-846.awsdns) and hosting provider, may reveal additional linked threats.