bybit-login[.]created[.]app

Analysis of the domain bybit-login.created.app, observed on 5 August 2026, indicates it is being used for credential phishing targeting users of the Bybit platform. The domain is registered through the service Created App, and its authoritative nameserver information is not publicly resolvable, reflecting a missing or deliberately concealed NS record. DNS resolution points to the IPv4 address 216.150.16.129, which is the sole hosting endpoint identified. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service, confirming that defensive products are already flagging it.

VirusTotal submitted the domain to 91 scanning engines; none reported a detection at the time of analysis, although the lack of a flag does not constitute evidence of legitimacy. The site remains reachable and is classified as active. No SSL certificate data, HTTP status code, or page title information is currently available, leaving the transport‑layer characteristics and content response unknown.

Defenders should add the domain to local deny lists, monitor DNS queries for the associated IP, and enforce URL filtering to prevent end‑user exposure. Network capture of any traffic to the IP can reveal additional indicators such as server banners or request patterns. Continuous re‑evaluation is recommended, as further intelligence—including TLS fingerprint, response headers, or observed login page content—may become available and could alter the risk posture.