verifica-bybit[.]com

Analysis of verifica-bybit.com indicates a confirmed brand‑impersonation operation targeting users of the Bybit cryptocurrency exchange. The domain was registered on October 5, 2025 through OwnRegistrar, Inc., and is hosted on the IP address 91.215.85.148, which resolves to the Russian autonomous system AS200593 operated by PROSPERO OOO. DNS resolution uses three dnspod.com nameservers (a.dnspod.com, b.dnspod.com, c.dnspod.com), a configuration commonly observed in malicious infrastructure. No TLS certificate is presented for the site, implying HTTP‑only service and a lack of transport‑layer security.

The site is currently offline, and the phishing‑specific blocklist PhishDestroy has taken it down; it also appears on a single additional security blocklist. Reputation services show a very low Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. VirusTotal scans have flagged the domain in 16 of 95 antivirus and URL‑reputation engines, providing independent confirmation of its illicit nature. AlienVault OTX references the domain in 16 separate threat‑intel pulses, further evidencing its use in cyber‑crime campaigns.

The operational intent is classified as a crypto scam, consistent with the Bybit brand impersonation theme. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the associated IP address, and update intrusion‑detection signatures to flag any HTTP requests to the listed dnspod.com nameservers resolving to the same IP. Given the elevated risk rating, security teams should also consider adding the domain and associated IP to threat‑intel feeds and alerting users about potential phishing attempts that claim to originate from Bybit but direct to this infrastructure.