sync-bybit[.]one

This domain, sync-bybit.one, is identified as a brand impersonation threat targeting Bybit, a cryptocurrency exchange platform. Analysis indicates the site presents a fraudulent page titled 'Bybit Audit,' designed to deceive users into submitting sensitive credentials or wallet information under the guise of a security verification process. The infrastructure aligns with known phishing campaigns aimed at cryptocurrency users, where attackers exploit trust in brand names to facilitate unauthorized access to digital assets. Infrastructure analysis reveals sync-bybit.one was registered on February 21, 2026, and resolves to the IP address 172.86.94.172, hosted on AS30823 (aurologic GmbH) in Germany. The domain is flagged by 18 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on one security blocklist, and its SSL certificate (serial number E7) lacks extended validation, a common trait in phishing sites. The domain's creation date suggests it was deployed with a short operational lifespan, typical of disposable phishing infrastructure. Currently, sync-bybit.one is offline, having been taken down following detection by security systems. Despite its inactive status, residual risk remains due to potential reuse of the IP or SSL certificate in future campaigns. Users who interacted with the site should assume credential exposure and initiate account recovery protocols, including password resets and wallet address rotation. Organizations are advised to monitor for related domains using similar naming conventions (e.g., 'sync-[brand].one') and block the associated IP range to mitigate further exposure.