by-bit[.]help

PhishDestroy identifies by-bit.help as a live domain actively impersonating the Bybit cryptocurrency exchange to harvest user credentials and payment data. The page title contains Chinese characters translating to 'Bybit connection guide,' suggesting a lure targeting non-English-speaking traders. No drainer kit artifacts are visible in public sources at this time, but the page layout mirrors Bybit’s official site, indicating a likely credential-harvesting or fake KYC upload scheme. Registrar NameSilo, LLC, and Let’s Encrypt SSL suggest low-cost, rapid deployment typical of opportunistic brand abuse campaigns. The domain resolves to 193.134.210.8, a server linked to multiple low-reputation hosting providers in the past six months, increasing the likelihood of additional malicious payloads. This domain was flagged with zero detections on VirusTotal out of 95 engines, a status that persists despite active hosting. It was registered on December 12, 2025 through NameSilo, LLC, and is currently served via IP 193.134.210.8. Google Safe Browsing has not yet blacklisted the domain, and public blocklist aggregators show no current listings. Historical whois data reveals the registrant masked their identity behind NameSilo’s privacy service, a common tactic to delay takedowns. Passive DNS indicates the IP previously hosted other brand-impersonation domains targeting financial services, reinforcing the pattern of reuse for financially motivated attacks. The domain remains active and is serving the impersonation page as of the latest telemetry. Immediate containment actions include submitting the domain and IP to internal blocklists and coordinating with NameSilo for emergency suspension under their abuse policy. Users should avoid accessing by-bit.help and treat any emails or messages referencing this domain as malicious. Remaining risk is assessed as moderate due to zero detections and absence from blocklists, which can allow the site to persist until wider threat intelligence coverage is achieved. Continuous monitoring is recommended to capture any shifts to malicious binaries or additional infrastructure.