bybitcloud[.]vip

Bybitcloud.vip is a fraudulent website posing as the legitimate cryptocurrency exchange Bybit in order to steal user login credentials and sensitive account information. The site mimics Bybit’s branding and login interface, tricking visitors into entering their email addresses, passwords, and even two-factor authentication codes. Once harvested, these credentials are used to take over real Bybit accounts, drain funds, and conduct additional fraud against the victim and their contacts. This is a classic brand-impersonation attack designed to exploit trust in a well-known exchange. PhishDestroy identifies this threat using multiple security lenses. The domain was registered on March 20, 2026, through Dynadot Inc and uses a Let’s Encrypt SSL certificate to appear legitimate. VirusTotal currently flags the site with 13 out of 95 security vendors detecting malicious content, indicating a high-risk impersonation campaign already in motion. The site resolves to IP address 188.137.180.57, which has no association with Bybit’s official infrastructure. If you visited bybitcloud.vip, immediately cease using the site and assume your credentials may be compromised. Do not log in again anywhere, including on the real Bybit platform. Revoke access to your Bybit account via the official app or website, enable two-factor authentication using an authenticator app (not SMS), and scan your device for malware. Report the domain to Bybit’s official fraud team and warn contacts who may have been targeted. Treat all emails or messages referencing this site as suspicious, and always verify links by typing the official URL (bybit.com) directly into your browser.