bybitclubin[.]my

The domain bybitclubin.my was registered on August 01, 2025 through Dynadot LLC and is hosted on IP address 206.119.171.228, which maps to a Japanese network (AS133199 SonderCloud Limited). The authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net are typical of dynamically allocated DNS services and provide no additional reputation signals. No TLS certificate is presented, indicating that the site was served over plain HTTP at the time it was observed. The page title returned by the web server reads "Bybit Digital Trading Platform", aligning with the declared scam type of a crypto scam and the listed impersonation of the Bybit exchange.

Google Safe Browsing has flagged the URL for social engineering, and the domain appears on a single external blocklist maintained by PhishDestroy. VirusTotal recorded scans by 95 antivirus and URL‑reputation engines, none of which reported a detection; while this suggests the payload was not recognized by those engines, it does not constitute a safety assurance. The site is currently offline, preventing immediate interaction, but the historical evidence indicates a deliberate attempt to mislead users by leveraging the Bybit brand.

Uncertainties remain regarding the specific phishing kit or credential‑capture mechanisms employed, as no page content or source‑code has been disclosed. Defensive actions should include adding the domain to internal blocklists, monitoring for any resurgence of the same IP or nameserver pair, and correlating any inbound traffic to the Bybit brand with this indicator set. Security teams should also advise users to verify the absence of TLS and to consult official Bybit communications when encountering unsolicited crypto‑related offers, as the combination of brand‑specific page title, social‑engineering flag, and lack of encryption are consistent with known impersonation campaigns.