bybit[.]beer

PhishDestroy identifies active crypto drainer brand impersonation at domain bybit.beer targeting Bybit users. This domain is currently unflagged despite its malicious intent and poses a direct threat to cryptocurrency users seeking to engage with the legitimate Bybit exchange.

This domain, registered under the name brand impersonation, was flagged by 4 of 95 VirusTotal vendors as of the latest scan. It was registered through Dynadot Inc and resolves to IP address 188.114.96.3. The domain was created on April 06, 2026, and employs a Let's Encrypt SSL certificate to appear legitimate. Additionally, the domain has not been listed on any known blocklists at this time, maintaining a high level of stealth.

The domain bybit.beer is currently active and should be considered a high-risk threat. Users attempting to access Bybit services should verify the legitimacy of the domain through official channels before entering any credentials or making transactions. Cryptocurrency users are advised to cross-check URLs against the official Bybit domain (bybit.com) and avoid clicking on links from untrusted sources. Security teams should block this domain at the network level and monitor for any related malicious activities. Immediate action is required to mitigate potential losses and prevent credential theft or fund drain.