kbybit[.]com

This domain, kbybit.com, represents a targeted brand-impersonation threat designed to deceive users of the cryptocurrency exchange Bybit. Analysis indicates the site mimics legitimate trading interfaces to harvest login credentials, two-factor authentication codes, and sensitive financial information. The fraudulent page displays a generic 'Buy' title, lacking the professional branding and security indicators of the authentic platform, suggesting an intent to exploit users through social engineering tactics. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through Amazon Registrar, Inc., and resolves to the IP address 66.114.63.57, hosted by AS54994 (Meteverse Limited) in the United States. Security vendor detection on VirusTotal shows 16 out of 95 engines flagging the domain as malicious, while it appears on two distinct security blocklists. The SSL certificate, issued by Amazon RSA 2048 M04, provides encrypted connections but does not validate the site's legitimacy, as fraudulent domains frequently leverage encryption to appear trustworthy. Users who visited kbybit.com should immediately revoke any credentials entered on the site and enable multi-factor authentication on their legitimate Bybit accounts. Financial transactions initiated through this domain should be reported to relevant authorities and payment processors for potential reversal. Monitoring for unauthorized account activity is critical, as stolen credentials may be used in subsequent attacks. The domain's current offline status does not eliminate risk, as threat actors may reactivate similar infrastructure under different names.