duplicate-disabled-4704.invalid

This domain is flagged as an elevated-risk brand impersonation phishing site specifically targeting Bybit, a cryptocurrency exchange. The infrastructure is designed to deceive users into believing they are interacting with legitimate Bybit services, potentially leading to credential theft, unauthorized transactions, or exposure to crypto-draining malware. The page title 'PNCEX' suggests an attempt to mimic alternative exchange branding, further obscuring the malicious intent under a seemingly plausible guise. Analysis indicates the domain www.bybitcoin.cn was registered on September 04, 2025, through Web Commerce Communications Limited. It currently resolves to the IP address 151.242.20.56 and has been taken offline following detection. VirusTotal reports that 2 out of 95 security vendors flag this domain as malicious, while it appears on one security blocklist. The domain's creation date, combined with its rapid takedown, suggests a short-lived but targeted campaign aimed at exploiting Bybit's user base. The use of a registrar with a history of facilitating malicious domains further elevates the risk profile. To mitigate risks associated with this threat, affected organizations and users should immediately revoke any credentials entered on this domain and monitor for unauthorized access to cryptocurrency wallets or exchange accounts. Security teams are advised to block the domain and its resolving IP (151.242.20.56) at the network level, including DNS and firewall rules. Users should enable multi-factor authentication (MFA) on all cryptocurrency-related accounts and verify the legitimacy of domains before entering sensitive information. Given the domain's offline status, vigilance for similar impersonation attempts using slight variations of Bybit's branding or domain structure is recommended.