bybitfiatpay[.]com

bybitfiatpay.com is a phishing domain that targets cryptocurrency users by impersonating the brand Bybit. The site, now offline, was detected by PhishDestroy and has been flagged by 2 out of 93 vendors on VirusTotal. Additionally, it appears on one public blocklist, specifically PhishDestroy's own.

The domain was registered through Vautron Rechenzentrum AG and hosted on IP 144.91.80.97, located in France under the organization Contabo GmbH. Notably, the site did not employ SSL encryption, which is a common trait among phishing sites aiming to cut costs and avoid detection. The page title, "Live Agent," suggests an attempt to lure users into real-time interactions, possibly to extract sensitive information.

This domain exemplifies the tactics used by cybercriminals to exploit the cryptocurrency sector. Bybit, a legitimate cryptocurrency exchange, is a prime target due to its large user base. The attackers likely aimed to harvest login credentials or financial details from unsuspecting users. The site was taken down before it could cause significant harm, thanks to early detection by PhishDestroy. This quick action underscores the importance of proactive threat intelligence in combating phishing attacks.