bybitvotes[.]fun

The domain bybitvotes.fun is a cryptocurrency phishing site engaged in brand impersonation targeting Bybit, a well-known cryptocurrency exchange. This scam site posed as a legitimate Bybit platform, likely attempting to deceive users into disclosing login credentials or other sensitive information under the guise of a voting or promotional event. As of the latest verification, bybitvotes.fun has been taken offline, though it previously exhibited elevated risk due to its fraudulent activity.

Technical analysis of bybitvotes.fun reveals limited but notable detection: 2 of 95 security vendors on VirusTotal flagged the domain, including Gridinsoft and SOCRadar. The domain was registered through Dynadot LLC on March 02, 2026, and resolved to the IP address 172.67.128.219, hosted on Cloudflare's infrastructure in the US. It appeared on three security blocklists, specifically PhishDestroy, MetaMask, and SEAL. No SSL certificate was issued for the domain, and the observed page title was 'ByVotes'. The nameservers were ali.ns.cloudflare.com and piers.ns.cloudflare.com.

Users who interacted with bybitvotes.fun should immediately change their Bybit account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized transactions or login attempts. If cryptocurrency transactions were initiated, revoke any token approvals granted to unknown contracts using tools like Etherscan or BscScan. Report the phishing domain to Bybit's official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.