bybittrc[.]com

This domain, bybittrc.com, is flagged as an active brand impersonation threat targeting BYBIT, a cryptocurrency exchange platform. Analysis indicates the domain is designed to harvest user credentials through a fraudulent login interface, as evidenced by its page title 'BYBIT' and its inclusion on one security blocklist. The infrastructure mimics legitimate BYBIT properties, increasing the likelihood of successful deception among unsuspecting users. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on May 06, 2024, and resolves to the IP address 188.114.96.3, located in Canada and associated with CloudFlare, Inc. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. VirusTotal detection metrics show 17 out of 95 security vendors have flagged this domain as malicious, while it appears on one additional security blocklist. The domain is not currently listed on Google Safe Browsing. As of this report, bybittrc.com remains active and poses an elevated risk to users. The domain's use of CloudFlare infrastructure complicates takedown efforts, while its recent registration and low initial detection rate suggest it may evade some automated defenses. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on financial platforms, and report suspicious domains to their security teams or relevant authorities for further investigation.