bybit-iy[.]xyz

This domain, bybit-iy.xyz, is identified as a brand impersonation threat specifically targeting Bybit, a cryptocurrency exchange platform. The site presents itself as the official Bybit portal, using localized Chinese content in the page title "Bybit官网 - 一键开户领取专属奖励 | 移动合约交易 2026" to lure users into engaging with fraudulent account registration or transaction processes. The primary risk involves credential theft or unauthorized fund transfers, as victims may unknowingly submit sensitive login details or wallet information to attackers. The domain’s infrastructure mimics legitimate exchange properties, increasing the likelihood of successful deception among users seeking account rewards or trading services. Analysis of the domain reveals multiple indicators of malicious intent. The domain was registered on February 25, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with newly created phishing infrastructure. Security vendors on VirusTotal flagged the domain, with 6 out of 95 engines detecting it as malicious. The site appears on one security blocklist and resolves to the IP address 160.124.210.245. Detected technologies include Nginx, HSTS, and HTTP/3, which are commonly used in both legitimate and malicious sites to enhance performance and security, further complicating detection efforts. The domain’s current offline status suggests takedown action, but its prior activity remains a concern for potential victims. Users who visited bybit-iy.xyz should immediately revoke any sessions or credentials entered on the site. If login details or wallet information were submitted, affected accounts must be secured by changing passwords and enabling multi-factor authentication on the legitimate Bybit platform. Wallet addresses or transaction details shared with the site should be considered compromised, and users are advised to monitor their accounts for unauthorized activity. Additionally, any browser sessions or cached data associated with the domain should be cleared to prevent residual tracking or exploitation. Organizations should update internal blocklists to include this domain and its resolving IP to prevent future access.