bybit-91n[.]pages[.]dev

The domain bybit-91n.pages.dev is a phishing site engaged in brand impersonation targeting Bybit, a cryptocurrency exchange. It was designed to deceive users into believing they are interacting with the legitimate Bybit platform, posing an elevated risk of credential theft or financial fraud. As of the latest verification, bybit-91n.pages.dev has been taken offline, though it previously operated as a cryptocurrency scam.

Technical analysis reveals that bybit-91n.pages.dev was flagged by 1 of 95 VirusTotal security vendors, including Trustwave, and was explicitly marked by Google Safe Browsing for 'SOCIAL_ENGINEERING' phishing activity. The domain appeared on 1 security blocklist (PhishDestroy) and was registered through Cloudflare, Inc. on August 16, 2025. It resolved to the IP address 104.21.96.1, hosted by Cloudflare in the US (AS13335), and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Bybit', reinforcing its impersonation of the legitimate brand. No drainer kit was associated with this campaign.

Users who interacted with bybit-91n.pages.dev should immediately change their Bybit account passwords, enable two-factor authentication (2FA), and monitor their accounts for unauthorized transactions or login attempts. If cryptocurrency was involved, revoke any token approvals granted to unknown contracts and consider transferring funds to a new wallet. Report the domain to Bybit’s official security team and file complaints with platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.