bybit-com[.]site

This domain, bybit-com.site, is identified as a brand impersonation threat targeting Bybit, a cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing it was the legitimate Bybit platform, likely for credential harvesting or fraudulent transactions. No specific drainer kit signatures were observed in the available data, but the infrastructure aligns with common phishing tactics used against crypto-related services. Infrastructure analysis reveals the domain was registered on February 21, 2026, through REGRU-RU, a registrar frequently associated with malicious domains. It resolved to the IP address 34.120.137.41, hosted on AS396982 (Google LLC) in the United States. The domain was flagged by 12 out of 95 security vendors on VirusTotal, appearing on one security blocklist. Notably, the site lacked an SSL certificate, a red flag for users accustomed to encrypted connections on legitimate platforms. Google Safe Browsing did not list the domain at the time of analysis, but its presence on other blocklists suggests prior detection by independent security researchers. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered, and similar domains may emerge using the same registrar or hosting provider. Users are advised to verify domain authenticity by cross-referencing official Bybit communication channels and employing multi-factor authentication for all crypto-related accounts. Organizations should monitor for domains registered through REGRU-RU or resolving to the same IP range, as these may indicate recurring phishing campaigns. The elevated risk level persists due to the potential for the threat actor to re-establish operations under a new domain.