bybit[.]net-sys[.]pro

The domain bybit.net-sys.pro was registered on February 21, 2026 through Global Domain Group LLC and is currently taken offline. DNS resolution points to IP address 80.66.89.171, which belongs to AS207957 SERV.HOST GROUP LTD located in Russia. The domain does not present an SSL certificate, indicating that any communication would occur over clear‑text HTTP. Nameserver records list a.dnspod.com and c.dnspod.com, both typical of the DNSPod service used by many threat actors for rapid domain provisioning.

The page title observed during the brief live period was "Bybit Wallet," and the domain is explicitly marked as impersonating the Bybit brand, aligning with the declared scam type of a crypto scam. Security telemetry shows that 16 of 93 antivirus and URL‑filtering engines on VirusTotal flagged the domain as malicious, reflecting a consensus of moderate to high confidence across vendors. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of the site as highly untrustworthy. The domain appears on a single public blocklist and is listed as blocked by PhishDestroy, indicating that at least one sink‑hole or community‑driven mitigation service has taken action against it.

Given the combination of brand impersonation, lack of transport encryption, a low‑reputation IP address, and multiple vendor detections, network defenders should add the domain and its resolved IP to outbound and inbound deny lists, monitor DNS queries for the domain and its nameservers, and consider expanding blocklist coverage to include related IP ranges owned by SERV.HOST GROUP LTD. Continuous observation of new domains registered by the same registrar or using the same nameserver pair may reveal further infrastructure reuse. Incident response teams should treat any credential or wallet information submitted to this domain as compromised and advise affected users to rotate credentials and secure any associated cryptocurrency assets.