bybitaoiu[.]com

PhishDestroy identifies domain bybitaoiu.com as an active crypto drainer impersonating the legitimate cryptocurrency exchange Bybit.

This domain masquerades as Bybit to deceive users into connecting malicious wallets or revealing sensitive credentials. As of today, VirusTotal reports that 13 out of 95 security vendors have flagged bybitaoiu.com as malicious. The domain was registered through DYNADOT LLC on May 11, 2026, and currently resolves to IP address 104.18.21.48. It is blocked by OpenPhish and appears on one additional security blocklist. The SSL certificate for this domain was issued by Let's Encrypt, which does not inherently indicate legitimacy, as threat actors frequently exploit free certificate authorities to establish false trust. Additionally, this domain has a low domain trust score, further corroborating its malicious intent.

Given the elevated risk posed by this domain, PhishDestroy recommends immediate action to block bybitaoiu.com at the network and endpoint levels. Users should avoid accessing this domain and verify any Bybit-related communications through official channels. Organizations are advised to update firewall rules, DNS sinkholes, and email filtering policies to include bybitaoiu.com and its associated IP address. Continuous monitoring of this domain and related infrastructure is strongly encouraged, as threat actors frequently modify hosting details to evade detection. Reporting this domain to PhishDestroy will help enhance collective threat intelligence and protect other potential targets from falling victim to this crypto drainer scheme.