restore-bybit.com 网络钓鱼与安全检查

The domain restore-bybit.com has been identified as an active brand impersonation threat targeting Bybit, a cryptocurrency exchange platform. Analysis indicates this infrastructure is designed to mimic legitimate Bybit support channels, likely to facilitate credential harvesting or unauthorized account access. The domain remains operational as of the latest verification, posing an elevated risk to users unfamiliar with official Bybit communication channels. Infrastructure analysis reveals the domain was registered on June 16, 2024, through DYNADOT LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.97.3 and has been flagged by 1 of 95 security vendors on VirusTotal, indicating limited but present detection. The domain appears on three independent security blocklists, including MetaMask, PhishDestroy, and SEAL, further corroborating its malicious classification. Additional technical indicators include a Gridinsoft trust score of 0/100 and a page title labeled 'Support,' reinforcing its intent to deceive users seeking assistance. Current status confirms the domain remains active, with no evidence of takedown or mitigation. Users are advised to avoid interaction with restore-bybit.com and verify all communications through official Bybit channels. Organizations should update blocklists to include this domain and its associated IP address. Cryptocurrency holders should enable multi-factor authentication and scrutinize URLs for subtle misspellings or inconsistencies. Security teams are encouraged to monitor for related infrastructure registered under the same registrar or resolving to the same IP range.