bybitrally[.]ru

bybitrally.ru is currently active and has been classified as a high‑risk brand‑impersonation site targeting users of the cryptocurrency exchange Bybit. The domain was registered on May 7 2026 through the TIMEWEB‑RU registrar and resolves to the IPv4 address 172.86.88.110. Geolocation data places the host in the United States and attributes the infrastructure to FranTech Solutions. The web server runs on Ubuntu with Nginx, is served over a Let's Encrypt certificate (E8), and returns HTTP 200 for the index page whose title reads “Rally Scanner Bybit”. Nameservers are operated by timeweb.ru and timeweb.org.

The site appears on at least one public blocklist and is already blocked by the PhishDestroy service. Reputation services assign low confidence scores: Scamadviser rates the domain 31 / 100, while Gridinsoft scores it 0 / 100. VirusTotal analysis shows a single security vendor flagging the domain out of ninety‑five scanned, indicating limited but present malicious indicators. The page content mimics Bybit branding, likely to harvest credentials or redirect victims to a malicious payload.

Open questions remain regarding the full phishing workflow. No explicit malicious payload, credential‑stealing form, or redirect URL has been captured in the available data, and the specific phishing kit or command‑and‑control infrastructure has not been identified. Continuous monitoring of the IP address and associated subdomains is advisable to detect any escalation in activity.

Defenders should add 172.86.88.110 and the hostname bybitrally.ru to network‑level deny lists, enforce URL filtering for any Bybit‑related traffic, and educate end‑users to verify the official Bybit domain before entering credentials. Incident response teams should capture any attempted connections to this host for forensic analysis and consider sharing observed indicators with community blocklists to improve detection coverage.