bnbit[.]win

PhishDestroy identifies bnbit.win as an active crypto drainer scam impersonating the Bybit exchange, posing a direct threat to cryptocurrency traders. The domain's primary objective is to trick victims into connecting wallets or entering credentials, enabling unauthorized fund transfers. Given the recent domain registration date and lack of detection on VirusTotal, users should treat this as a high-risk threat until further analysis confirms otherwise. This domain exhibits multiple red flags across key threat intelligence vectors. Domain creation occurred on March 09, 2026, with resolution to IP address 172.67.145.206. The malicious infrastructure is hosted under a Let's Encrypt SSL certificate, while domain registration was processed through Gname.com Pte. Ltd. Notably, the domain currently shows zero detections across 95 VirusTotal scans, indicating it remains undetected by most security vendors. These factors suggest either a newly deployed threat or one deliberately avoiding detection through low-profile infrastructure. The absence of blocklist entries or trust score degradation should not be interpreted as safety assurance. Users must implement platform-specific verification protocols before engaging with Bybit-related domains. Immediately block traffic to 172.67.145.206 at network boundaries, and instruct employees to access Bybit exclusively via verified bookmarks or the official bybit.com domain. Enable wallet connection warnings in browser extensions like PhishDestroy to intercept malicious dApps. Organizations should also report this domain to Gname.com for takedown through their abuse channels while monitoring for related certificate issuances.