bybit-copy-trade[.]com

On July 24, 2026, the domain bybit-copy-trade.com was identified as a brand‑impersonation site targeting users of the Bybit cryptocurrency exchange. The domain was registered through NiceNIC International Group Co., Limited on 17 July 2025 and resolves to the IPv4 address 146.103.43.235, which is hosted in Germany under autonomous system AS215311 operated by Regxa Company for Information Technology Ltd. No TLS certificate is presented, indicating the site was served over plain HTTP. The sole HTML title returned by the server reads “Bybit Copy Trading”, matching the declared scam type of a crypto‑related fraud. VirusTotal records show that one of ninety‑five scanning engines flagged the domain, and the site is listed on a single external blocklist.

PhishDestroy has also added the domain to its takedown list, and the current status is offline. The observable evidence confirms that the infrastructure was deliberately crafted to suggest an official Bybit copy‑trading service, a common lure for credential harvesting or funds diversion. However, the limited number of detections and the absence of SSL limit the depth of technical attribution; no malware hashes, command‑and‑control endpoints, or additional hosting artifacts have been disclosed. Defenders should immediately block the host IP and the domain at perimeter firewalls and DNS filtering solutions.

Continuous monitoring of the registrar NiceNIC and the associated ASN for new registrations resembling the same naming pattern is advised, as threat actors often reuse the same registration service. Since the site is already offline, incident response teams should still search internal logs for any client connections to the IP address or HTTP requests to the domain to identify potential exposure. Ongoing threat‑intel feeds should be consulted for any resurgence of similar Bybit‑related impersonation campaigns.