bybitll[.]com[.]cn

This domain, bybitll.com.cn, is flagged as a high-risk brand impersonation targeting Bybit. Registered on April 7, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to IP address 154.216.110.101, hosted in Hong Kong by Digital Core Technology Co., Limited. Its SSL certificate is issued by Let's Encrypt (R13). The page title, decoded, reads as official Bybit website and trading platform content, consistent with a phishing page designed to mimic the legitimate cryptocurrency exchange. VirusTotal analysis shows 6 out of 94 security vendors flagging the domain as malicious. It appears on one security blocklist (PhishDestroy) and has been identified in one AlienVault OTX threat intelligence pulse. The domain's nameservers are ns1.domainnamens.com and ns2.domainnamens.com. The HTTP status is 444, indicating the server may be configured to drop connections without response, possibly as a defensive measure or to evade analysis. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of high risk. At the time of this report, the domain remains active. Defenders should block this domain at the network level, monitor for related subdomains or similar registrations, and alert users who may have been directed to it. The exact content and functionality of the phishing page have not been directly observed, but the infrastructure and detection signals strongly indicate it is part of an ongoing campaign against Bybit.