bybit[.]nomba[.]com

This domain is flagged as a confirmed brand impersonation phishing site targeting Bybit users. Analysis indicates the threat type involves fraudulent P2P payment automation tools designed to harvest credentials or financial data under the guise of legitimate Bybit services. The risk level is classified as elevated due to its active impersonation of a major cryptocurrency exchange platform. Infrastructure analysis reveals the domain bybit.nomba.com resolves to IP address 185.158.133.1 and was registered through GoDaddy.com, LLC on February 21, 2026. It is currently offline but was previously detected by 3 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100. Additional technical indicators include the use of Cloudflare for hosting, HSTS implementation, and an SSL certificate issued by Google Trust Services. The page title, 'Nomba P2P Automation | Automate Your Bybit P2P Payments,' directly references Bybit’s services to deceive users. Mitigation steps for this threat type include blocking the domain and its associated IP (185.158.133.1) at the network perimeter. Organizations should update endpoint protection rules to flag or quarantine any connections to this domain. Users should be educated on verifying domain authenticity before entering credentials, particularly for cryptocurrency platforms. Security teams are advised to monitor for related domains registered through the same registrar (GoDaddy.com, LLC) or resolving to the same IP range, as threat actors may reuse infrastructure for future campaigns.