ww2[.]biz

On 23 July 2026 analysts assessed ww2.biz, a domain created on 12 August 2025 and currently taken offline. The domain resolves to the IPv4 address 103.117.138.20, which is assigned to AS141159 Incomparable(HK)Network Co., Limited and geolocated to Hong Kong. Registration was performed through Gname.com Pte. Ltd. and the authoritative name servers are a.share-dns.com, a10.share-dns.com, b.share-dns.net and b10.share-dns.net. No TLS certificate was observed, indicating the site was served over plain HTTP. The page title returned by the server reads “bybit官网中文版 - bybit中文交易所 - 快速上手无压力”, directly referencing the Bybit brand and confirming a Chinese-language impersonation of the cryptocurrency exchange.

The threat is classified as a crypto‑scam and brand impersonation targeting Bybit users. VirusTotal scanned the site and 15 of 95 security vendors reported it as malicious. The domain appears on one public blocklist and has been blocked by the PhishDestroy service. Open Threat Exchange (OTX) references the domain in fourteen separate intelligence pulses, reinforcing its association with malicious activity. Despite the offline status, the infrastructure artifacts remain observable.

The lack of an SSL certificate, the use of shared DNS services, and the Hong‑based hosting are consistent with prior Bybit‑related impersonation campaigns. No additional content analysis is available beyond the page title, so the exact malicious payload or credential‑harvesting mechanisms cannot be confirmed at this time. Defenders should continue to block resolutions to 103.117.138.20, add ww2.biz to URL filtering rules, and monitor Gname.com‑registered domains that resolve to the same ASN for similar patterns. Maintaining updated feeds from PhishDestroy, OTX and VirusTotal will ensure rapid detection should the site be re‑hosted. The elevated risk rating reflects the confirmed brand impersonation and the observed detection history.