amlbybitfree[.]com

This investigation documents amlbybitfree.com, a domain registered through Global Domain Group LLC on 15 July 2025. The site resolves to the IPv4 address 94.176.236.96, which is advertised as belonging to AS212531 Interneto vizija in Lithuania. The domain appears on three independent security blocklists, specifically PhishDestroy, MetaMask, and SEAL, indicating that multiple threat‑intelligence feeds have flagged it as malicious. A Gridinsoft trust‑score of 0 / 100 further confirms a lack of reputation.

The SSL certificate associated with the host carries an R10 rating, a level that is typically assigned to certificates with minimal trust. VirusTotal analysis shows that seven of ninety‑five scanning engines have identified the domain as suspicious, reinforcing the blocklist findings. The only visible page title returned by the server is “Доступ ограничен”, which translates to “Access restricted”, and the current HTTP status is offline, suggesting that the content has been taken down or is otherwise unavailable. The domain is classified as a crypto‑scam that impersonates the Bybit exchange brand.

Because the site is already offline, immediate mitigation focuses on preventing future use of the same infrastructure: defenders should block the IP 94.176.236.96 at network perimeters, add the domain to internal deny lists, and monitor the registrar Global Domain Group LLC for additional registrations that share similar naming patterns. Continuous monitoring of the listed blocklists and periodic VirusTotal rescans are recommended to capture any re‑activation attempts. Until further evidence emerges, the domain should be treated as a high‑confidence impersonation threat targeting cryptocurrency users.