bybit-keyless-wallet[.]org

This domain, bybit-keyless-wallet.org, is actively flagged as a high-risk crypto scam impersonating the Bybit brand. Registered on February 21, 2026, through Global Domain Group LLC, the domain resolves to a German-hosted IP address (136.243.14.123) under AS24940, operated by Hetzner Online GmbH. Infrastructure analysis reveals the use of nameservers ns33.link-host.net and ns34.link-host.net, a pattern consistent with known phishing operations. The SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as fraudulent domains frequently leverage free certificates to appear legitimate. The domain is currently active, returning an HTTP 200 status, though the page title reads 'Account disabled by server administrator,' which may indicate temporary takedown efforts or evasion tactics. It appears on one security blocklist (PhishDestroy) and is classified as a crypto scam, aligning with the impersonation of Bybit, a major cryptocurrency exchange. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. While only one of 93 security vendors on VirusTotal flags the domain, this limited detection does not diminish the confirmed threat indicators, including its registration details, hosting provider, and blocklist status. Defenders should treat this domain as compromised infrastructure. Immediate actions include blocking the domain and its associated IP at the network level, monitoring for related subdomains or redirects, and alerting users to avoid interaction. The exact content of the site remains unanalyzed, but the available evidence—brand impersonation, hosting on a bulletproof provider, and active blocklist presence—justifies its classification as a high-risk threat.