bybit-exchange[.]online

PhishDestroy has identified bybit-exchange.online as an active brand impersonation threat specifically targeting users of the Bybit cryptocurrency exchange. This domain is engineered to mimic legitimate Bybit services, likely deploying a crypto drainer or fake login page designed to steal account credentials and digital assets. The site's title, 'Checking your browser...', is a common tactic used to evade automated scanners while presenting a plausible delay before loading malicious content.

Technical analysis reveals several red flags. VirusTotal data shows 3 out of 95 security vendors flag this domain as malicious, indicating broad but not universal detection. The domain appears on 3 security blocklists and is referenced in 1 AlienVault OTX threat intelligence pulse, confirming its inclusion in curated threat databases. Registered through GMO Internet Group, Inc. d/b/a Onamae.com, the domain was created on May 11, 2026, making it very recent—a hallmark of phishing infrastructure. It resolves to IP address 172.104.251.198, which may host other fraudulent domains.

Users who have visited bybit-exchange.online should immediately change their Bybit account passwords and enable two-factor authentication if not already active. They should also scan their devices for malware and monitor financial accounts for unauthorized transactions. To verify the legitimacy of any Bybit-related site, always use the official domain or consult PhishDestroy's verified list. Never enter credentials or private keys on sites accessed via unsolicited links or search ads.