bybitcoin[.]cn

On July 24, 2026 analysts observed that the domain bybitcoin.cn was registered on February 21, 2026 and is currently taken offline. The site was identified as a crypto‑scam impersonating the Bybit exchange, with the page title reported as “PNCEX”. Infrastructure analysis shows the domain resolves to the IPv4 address 151.242.20.56, which is geo‑located to Hong Kong and associated with OWGELS INTERNATIONAL CO., LIMITED. The authoritative nameservers are a.share-dns.com and b.share-dns.net, both typical of shared‑hosting services. The TLS certificate presented is identified as “R13”, indicating a relatively recent issuance, but no further certificate details are publicly disclosed.

Detection evidence indicates that two of ninety‑three VirusTotal scanners flagged the domain, and it appears on a single security blocklist. PhishDestroy has listed the domain as blocked, confirming that at least one anti‑phishing feed is actively monitoring the indicator. The risk rating assigned to the indicator is elevated, reflecting the potential financial impact of a Bybit‑related crypto fraud. While the site is presently offline, the combination of a recent registration date, a Hong Kong‑based hosting provider, and the use of a brand‑specific page title suggests a deliberate attempt to lure Bybit users into a fraudulent transaction flow.

Defenders should continue to block the domain at perimeter and DNS layers, add the IP address 151.242.20.56 to network‑level deny lists, and monitor for any re‑registration or resurrection of the domain. Additional scrutiny of traffic to the associated nameservers a.share-dns.com and b.share-dns.net may reveal related malicious infrastructure. Because the page content has not been captured, further analysis is required if the domain becomes active again. Organizations using Bybit should remind users to verify URLs and avoid unsolicited requests for cryptocurrency transfers.