bb-audits[.]info

The domain bb-audits.info was observed on 25 July 2026 as part of an active brand‑impersonation campaign targeting Bybit. The site presents the page title “Bybit Audit”, which aligns with the declared scam type of a crypto‑related fraud. Registration data indicates the domain was created on 21 February 2026 and is listed under the registrar Global Domain Group LLC. No TLS certificate is associated with the host, meaning the site is served over plain HTTP, a common characteristic of low‑cost phishing infrastructure. DNS resolution points to the IP address 91.92.242.117, which belongs to AS202412 operated by Omegatech LTD and is geolocated in the Netherlands.

The domain uses Cloudflare nameservers (simon.ns.cloudflare.com and harmony.ns.cloudflare.com), suggesting the attacker is leveraging Cloudflare’s DNS services to obscure the true hosting provider. Reputation checks show the domain appears on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis reports ten of ninety‑three scanners flagging the domain as malicious, providing additional corroboration of its illicit nature. The available evidence confirms the domain’s intent to impersonate Bybit and to solicit cryptocurrency‑related interactions, but the specific payload or credential‑harvesting mechanisms have not been publicly disclosed.

Defenders should add the domain to URL filtering rules, enforce TLS inspection where possible, and monitor outbound connections to the identified IP address. Network‑level blocks at the firewall or proxy level, combined with user awareness training about unsolicited “audit” communications from Bybit, will reduce exposure. Continuous re‑evaluation is advised, as the infrastructure may evolve or additional indicators could emerge.