amlaudit[.]info

amlaudit.info is currently offline but historical data indicates it was used for a Bybit brand impersonation campaign. The site was registered through Cloudflare, Inc. and hosted on Cloudflare’s network (AS13335) with the IP address 188.114.97.3 located in the United States. Both authoritative name servers—gail.ns.cloudflare.com and nico.ns.cloudflare.com—are Cloudflare‑owned, confirming the infrastructure is fully provided by the registrar. The page title observed was “Bybit Audit,” directly referencing the target brand and suggesting a wallet or seed phishing motive, which aligns with the classified scam type “Wallet/Seed Phishing.” Scamadviser assigned a trust score of 1 out of 100, reflecting extreme suspicion.

The domain appears on a single security blocklist and has been flagged by PhishDestroy, indicating active mitigation by at least one anti‑phishing service. VirusTotal scans reported 15 detections out of 95 engines, and AlienVault OTX listed the domain in 16 threat‑intel pulses, providing independent corroboration of malicious intent. No SSL certificate was observed, meaning any HTTP traffic would be unencrypted, a common characteristic of hastily deployed fraudulent sites. The evidence confirms that the domain was leveraged to lure victims into disclosing cryptocurrency wallet credentials under the guise of a Bybit audit.

Because the site is now offline, immediate traffic blocking may have limited impact, but defenders should continue to monitor the associated IP address and Cloudflare name servers for reuse. It is unclear whether the same IP or name servers will host additional malicious domains. Adding the domain to internal blocklists, enforcing DNS filtering, and alerting users about unsolicited “audit” communications from Bybit are recommended. Further investigation of the 15 VirusTotal detections could reveal payloads or command‑and‑control endpoints that may be reused elsewhere.