Bybit

Crypto & web3 United Arab Emiratesbybit.comRank 218 of the most impersonated
Cert findings · 24 h
3
Cert findings · 7 days
25
8 reported or listed · 17 on phishing hosts
Registered lookalikes
276
44 listed by a source or an address list
Official domains
10
verified from Bybit's own sites and records

Certificate findings for Bybit

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Bybit's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 35 findings, grouped by hostname

  1. bybit-exchange.online SG · AS63949 · Akamai Connected Cloud8 addresses
    ListedParking page · Shared parking pageListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    bybit-exchange.online
    First seen
    2026-11-05 05:41 UTC
    First published
    2026-11-05 06:25 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 06:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-05 04:38 UTC to 2027-02-03 04:38 UTC
    Logged 2026-11-05 05:36 UTC in Google ParcelYard2027h1, entry 620,461,779
    SHA-256 861c46a3d6accae002493d18080e6d14f9ebd8ad81f0175ddd25ce9976699841
    Public key SHA-256 875ef6abb1aa514987afc62532af738f717ba34aeff203efe41b57cc08467d1a
    Brand
    Bybit
    Addresses
    45.33.83.100 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Shared parking page (parking page)
    45.79.167.180 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Shared parking page (parking page)
    66.175.209.179 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Shared parking page (parking page)
    96.126.111.165 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Shared parking page (parking page)
    2600:3c03::f03c:95ff:fe00:29ca
    2600:3c03::f03c:95ff:fe91:5d52
    2600:3c03::f03c:95ff:feed:4d4f
    2600:3c03::f03c:95ff:feed:cf2a
    Parking page · Shared parking page
    Shared parking page (45.33.83.100, 45.79.167.180, 66.175.209.179, 96.126.111.165): a parking service. It answers for names that are typically for sale or unused.
    Domain
    bybit-exchange.online
    Registered
    2026-05-09 · GMO Internet Group, Inc. d/b/a Onamae.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:45 UTC

    Suggest a correction

  2. bybitexchange.online SG · AS63949 · Akamai Connected Cloud8 addresses
    ListedParking page · Shared parking pageListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    bybitexchange.online
    First seen
    2026-11-05 05:41 UTC
    First published
    2026-11-05 06:25 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 06:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-05 04:38 UTC to 2027-02-03 04:38 UTC
    Logged 2026-11-05 05:36 UTC in Google ParcelYard2027h1, entry 620,461,743
    SHA-256 3ea9f691f555bb09c51164a0098233ab2dbb8eb4b37e58b7c7df78089ce18c78
    Public key SHA-256 875ef6abb1aa514987afc62532af738f717ba34aeff203efe41b57cc08467d1a
    Brand
    Bybit
    Addresses
    45.33.83.100 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Shared parking page (parking page)
    45.79.167.180 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Shared parking page (parking page)
    66.175.209.179 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Shared parking page (parking page)
    96.126.111.165 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Shared parking page (parking page)
    2600:3c03::f03c:95ff:fe00:29ca
    2600:3c03::f03c:95ff:fe91:5d52
    2600:3c03::f03c:95ff:feed:4d4f
    2600:3c03::f03c:95ff:feed:cf2a
    Parking page · Shared parking page
    Shared parking page (45.33.83.100, 45.79.167.180, 66.175.209.179, 96.126.111.165): a parking service. It answers for names that are typically for sale or unused.
    Domain
    bybitexchange.online
    Registered
    2026-05-09 · GMO Internet Group, Inc. d/b/a Onamae.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:45 UTC

    Suggest a correction

  3. anounces-bybit.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 14 d ago
    DetailsHide
    Hostname
    anounces-bybit.com
    First seen
    2026-11-04 23:36 UTC
    First published
    2026-11-05 00:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-01-28 09:38 UTC
    Logged 2026-11-04 23:34 UTC in Geomys Tuscolo2027h1, entry 479,219,102
    SHA-256 95767e8fc3dfe0882cbc4048d5b0e2e8c0f2380d73f294eee5f1f506c2644964
    Public key SHA-256 16973c1c6508763d06e2280d9462c40d2d282c1764929e261414f45e72d376ca
    Brand
    Bybit
    Addresses
    104.21.91.61 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3036::6815:5b3d
    2606:4700:3036::ac43:d2e0
    Cloudflare
    Cloudflare (104.21.91.61, 172.67.210.224): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    anounces-bybit.com
    Registered
    2026-10-22 · Tucows Domains Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:42 UTC

    Suggest a correction

  4. announcement-bybit.com GB · AS215540 · GCS-AS GLOBAL CONNECTIVITY …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    announcement-bybit.com
    First seen
    2026-11-04 02:41 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.66.78.83.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.66.78.83
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 01:39 UTC to 2027-02-02 02:38 UTC
    Logged 2026-11-04 02:39 UTC in DigiCert Wyvern2027h1, entry 396,682,355
    SHA-256 6866933c1427b1af930740a644006f366f9eebb8b3017be59e3e9ca5e879958f
    Public key SHA-256 63c869b5e7e574e553ff1a8d319683d8b4985f1b4b09f256e44deb966cf311d9
    Brand
    Bybit
    Addresses
    80.66.78.83 · United Kingdom · AS215540 GCS-AS GLOBAL CONNECTIVITY SOLUTIONS LLP
    Domain
    announcement-bybit.com
    Registered
    2026-09-05 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  5. bybitweb3.vip US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    bybitweb3.vip
    First seen
    2026-11-03 18:39 UTC
    First published
    2026-11-03 19:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 19:33 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 17:39 UTC to 2027-02-01 18:35 UTC
    Logged 2026-11-03 18:39 UTC in Let's Encrypt Sycamore2027h1, entry 926,931,668
    SHA-256 f39a59a5062c9715d4c0e8ff92dd5308fb5223b45025ca84810947e8692d5ae6
    Public key SHA-256 f2d351e279164ed9b59bd20bd59af68c39bd26e5da676171aea08093e4c9d8da
    PhishDestroy
    Brand
    Bybit
    Addresses
    104.21.82.37 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.152.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:5225
    2606:4700:3037::ac43:98a8
    Cloudflare
    Cloudflare (104.21.82.37, 172.67.152.168): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bybitweb3.vip
    Registered
    2026-01-12 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  6. bybit-guide.ru US · AS54113 · Fastly, Inc.4 addresses
    ReportedFastlyReported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    bybit-guide.ru
    First seen
    2026-11-03 10:51 UTC
    First published
    2026-11-03 11:04 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-10-29 · still listed at the last successful feed check 2026-11-05 05:51 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-28 (3 days)
    DNS
    Resolves · checked 2026-11-04 11:13 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-03 09:49 UTC to 2027-02-01 09:49 UTC
    Logged 2026-11-03 10:47 UTC in Geomys Tuscolo2027h1, entry 457,869,776
    SHA-256 4be4b516f139a166cb5e7c15db973d95011347d85253d9614c04d98599233729
    Public key SHA-256 0d073b9b73b4b0ee16e3f580e521c7b6c7aa20a48a764a758e1b31dff5043d90
    PhishDestroy
    Brand
    Bybit
    Addresses
    185.199.108.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.109.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.110.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.111.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bybit-guide.ru
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  7. www.bybit-guide.ru US · AS54113 · Fastly, Inc.8 addresses
    ReportedFastlyUnder bybit-guide.ru, reported by PhishDestroyMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.bybit-guide.ru
    First seen
    2026-11-03 10:51 UTC
    First published
    2026-11-03 11:04 UTC
    Listing
    PhishDestroy: observed back in the feed 2026-10-29 · still listed at the last successful feed check 2026-11-05 05:51 UTC · listed 2 times
    Earlier listing periods: 2026-10-25 to 2026-10-28 (3 days)
    DNS
    Resolves · checked 2026-11-04 11:13 UTC
    Reported
    PhishDestroy, listing bybit-guide.ru and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-03 09:49 UTC to 2027-02-01 09:49 UTC
    Logged 2026-11-03 10:47 UTC in Geomys Tuscolo2027h1, entry 457,869,776
    SHA-256 4be4b516f139a166cb5e7c15db973d95011347d85253d9614c04d98599233729
    Public key SHA-256 0d073b9b73b4b0ee16e3f580e521c7b6c7aa20a48a764a758e1b31dff5043d90
    PhishDestroy
    Brand
    Bybit
    Addresses
    185.199.108.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.109.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.110.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    185.199.111.153 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    2606:50c0:8000::153
    2606:50c0:8001::153
    2606:50c0:8002::153
    2606:50c0:8003::153
    Fastly
    Fastly (185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bybit-guide.ru
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  8. www.bybit-consulting.help SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 3 d ago
    DetailsHide
    Hostname
    www.bybit-consulting.help
    First seen
    2026-11-03 06:47 UTC
    First published
    2026-11-03 07:43 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 05:46 UTC to 2027-02-01 05:46 UTC
    Logged 2026-11-03 06:44 UTC in Geomys Tuscolo2027h1, entry 455,336,575
    SHA-256 1bf4a246896e45eecd0c237f47a150a4061a18f5d3d6fd2734549437a44a8b03
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Bybit
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    bybit-consulting.help
    Registered
    2026-11-02 · NameSilo, LLC
    MX
    Receives mail at mx.zoho.eu, mx2.zoho.eu, mx3.zoho.eu
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  9. bybit-consulting.help SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 3 d ago
    DetailsHide
    Hostname
    bybit-consulting.help
    First seen
    2026-11-03 05:51 UTC
    First published
    2026-11-03 06:36 UTC
    DNS
    Resolves · checked 2026-11-05 06:39 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 04:47 UTC to 2027-02-01 04:47 UTC
    Logged 2026-11-03 05:46 UTC in DigiCert Sphinx2027h1, entry 339,076,555
    SHA-256 9b968b7dc7de55e629c89cde7d76e27ebebd33720de03b3121ae99ae6e629c57
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Bybit
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    bybit-consulting.help
    Registered
    2026-11-02 · NameSilo, LLC
    MX
    Receives mail at mx.zoho.eu, mx2.zoho.eu, mx3.zoho.eu
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  10. www.es-bybit.eu CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.es-bybit.eu
    First seen
    2026-11-02 14:06 UTC
    First published
    2026-11-02 14:21 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 13:04 UTC to 2027-01-31 13:04 UTC
    Logged 2026-11-02 14:03 UTC in Let's Encrypt Willow2027h1, entry 897,300,259
    SHA-256 6752e6fbedb5785899a45320404e6cb3567abce2dee3f67f02ade5418462e07e
    Public key SHA-256 08124df031efd01438e7d20339b1adf62034cbd4acffb6aed72ed8ead04faf5e
    Brand
    Bybit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    es-bybit.eu
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  11. es-bybit.eu CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    es-bybit.eu
    First seen
    2026-11-02 14:06 UTC
    First published
    2026-11-02 14:21 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 13:04 UTC to 2027-01-31 13:04 UTC
    Logged 2026-11-02 14:03 UTC in Let's Encrypt Willow2027h1, entry 897,300,259
    SHA-256 6752e6fbedb5785899a45320404e6cb3567abce2dee3f67f02ade5418462e07e
    Public key SHA-256 08124df031efd01438e7d20339b1adf62034cbd4acffb6aed72ed8ead04faf5e
    Brand
    Bybit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    es-bybit.eu
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  12. www.i-bybit.online RU · AS197695 · AS-REGRU "Domain names regi…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    www.i-bybit.online
    First seen
    2026-11-02 11:42 UTC
    First published
    2026-11-02 12:24 UTC
    DNS
    Resolves · checked 2026-11-04 12:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 95.163.244.138
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-02 10:39 UTC to 2027-01-31 10:39 UTC
    Logged 2026-11-02 11:37 UTC in Google PlumbersArms2027h1, entry 571,732,856
    SHA-256 719ffc804f233fb9a075f2854a0f605a05a61c41150843f0cbca06b9b6142cad
    Public key SHA-256 61a056555dbbf2dc2227c90a728bc3ac34bc1dd0318e9f17e5aa6161055ae508
    Brand
    Bybit
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd
    Domain
    i-bybit.online
    Registered
    2026-08-20 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:36 UTC

    Suggest a correction

  13. i-bybit.online RU · AS197695 · AS-REGRU "Domain names regi…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    i-bybit.online
    First seen
    2026-11-02 11:42 UTC
    First published
    2026-11-02 12:24 UTC
    DNS
    Resolves · checked 2026-11-04 12:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 95.163.244.138
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-02 10:39 UTC to 2027-01-31 10:39 UTC
    Logged 2026-11-02 11:37 UTC in Google PlumbersArms2027h1, entry 571,732,856
    SHA-256 719ffc804f233fb9a075f2854a0f605a05a61c41150843f0cbca06b9b6142cad
    Public key SHA-256 61a056555dbbf2dc2227c90a728bc3ac34bc1dd0318e9f17e5aa6161055ae508
    Brand
    Bybit
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd
    Domain
    i-bybit.online
    Registered
    2026-08-20 · Registrar of Domain Names REG.RU LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:36 UTC

    Suggest a correction

  14. www.bybit-signotice.ru RU · AS197695 · AS-REGRU "Domain names regi…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    www.bybit-signotice.ru
    First seen
    2026-11-01 16:17 UTC
    First published
    2026-11-01 16:25 UTC
    DNS
    Resolves · checked 2026-11-04 16:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 95.163.244.138
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 15:15 UTC to 2027-01-30 15:15 UTC
    Logged 2026-11-01 16:14 UTC in Geomys Tuscolo2027h1, entry 434,294,248
    SHA-256 700e523e38cd0c3ab8d300a238a1084df0b3c89c7e13921da2ae1ce52b06955e
    Public key SHA-256 97cf2e73061781964e1a97c557439019873b13c009a1d794433fd2f7fb2c7f33
    Brand
    Bybit
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd
    Domain
    bybit-signotice.ru
    MX
    Receives mail at mxs1.reg.ru, mxs2.reg.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  15. bybit-signotice.ru RU · AS197695 · AS-REGRU "Domain names regi…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    bybit-signotice.ru
    First seen
    2026-11-01 16:16 UTC
    First published
    2026-11-01 16:25 UTC
    DNS
    Resolves · checked 2026-11-04 16:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 95.163.244.138.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 95.163.244.138
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 15:15 UTC to 2027-01-30 15:15 UTC
    Logged 2026-11-01 16:14 UTC in Geomys Tuscolo2027h1, entry 434,294,248
    SHA-256 700e523e38cd0c3ab8d300a238a1084df0b3c89c7e13921da2ae1ce52b06955e
    Public key SHA-256 97cf2e73061781964e1a97c557439019873b13c009a1d794433fd2f7fb2c7f33
    Brand
    Bybit
    Addresses
    95.163.244.138 · Russia · AS197695 AS-REGRU "Domain names registrar REG.RU", Ltd
    Domain
    bybit-signotice.ru
    MX
    Receives mail at mxs1.reg.ru, mxs2.reg.ru
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  16. bybitweb3.biz US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    bybitweb3.biz
    First seen
    2026-11-01 08:46 UTC
    First published
    2026-11-01 09:09 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:21 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-01 00:00 UTC to 2027-01-27 23:29 UTC
    Logged 2026-11-01 08:43 UTC in DigiCert Wyvern2027h1, entry 372,406,353
    SHA-256 2b256c9a4de4ae9f8f4a98db2a92efb6f299081d904df873f4462d5a148acea4
    Public key SHA-256 56a14bcb5f77804ba2905e9f63a511322965bdc45324ed6c736289f384fe78f3
    PhishDestroy
    Brand
    Bybit
    Addresses
    104.21.38.83 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.220.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::ac43:dcc5
    2606:4700:3036::6815:2653
    Cloudflare
    Cloudflare (104.21.38.83, 172.67.220.197): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bybitweb3.biz
    Registered
    2026-01-22 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  17. www.bybiteu.uk PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 16 mo ago
    DetailsHide
    Hostname
    www.bybiteu.uk
    First seen
    2026-11-01 03:56 UTC
    First published
    2026-11-01 05:03 UTC
    DNS
    Resolves · checked 2026-11-05 05:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 02:54 UTC to 2027-01-30 02:54 UTC
    Logged 2026-11-01 03:52 UTC in DigiCert Wyvern2027h1, entry 371,228,778
    SHA-256 b18482a60cd13889d53d674895be248f7f54c56a222eab9b3c9365fbb5f388c8
    Public key SHA-256 a132f0c72f19f812c122123bdc2d53b60592d34f3fdbec58658a8201d7f1a216
    Brand
    Bybit
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    bybiteu.uk
    Registered
    2025-07-01 · Key-Systems GmbH
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  18. bybiteu.uk PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 16 mo ago
    DetailsHide
    Hostname
    bybiteu.uk
    First seen
    2026-11-01 03:56 UTC
    First published
    2026-11-01 05:03 UTC
    DNS
    Resolves · checked 2026-11-05 05:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-01 02:54 UTC to 2027-01-30 02:54 UTC
    Logged 2026-11-01 03:52 UTC in DigiCert Wyvern2027h1, entry 371,228,778
    SHA-256 b18482a60cd13889d53d674895be248f7f54c56a222eab9b3c9365fbb5f388c8
    Public key SHA-256 a132f0c72f19f812c122123bdc2d53b60592d34f3fdbec58658a8201d7f1a216
    Brand
    Bybit
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    bybiteu.uk
    Registered
    2025-07-01 · Key-Systems GmbH
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  19. www.bybit24.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    www.bybit24.com
    First seen
    2026-10-30 20:11 UTC
    First published
    2026-10-30 20:43 UTC
    DNS
    Resolves · checked 2026-11-04 20:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-30 19:07 UTC to 2027-01-28 19:07 UTC
    Logged 2026-10-30 20:06 UTC in DigiCert Sphinx2027h1, entry 318,922,334
    SHA-256 2c11b8eb4484d6499351b02792e1921cd17a786d0f7dcb1c2125d978d7eea09a
    Public key SHA-256 a01ca6d4fc3366e73cb904fb535b0ab26ab55ed5c1cd7fc626da96b939ab947c
    Brand
    Bybit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    bybit24.com
    Registered
    2024-03-21 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  20. bybit24.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 3 y ago
    DetailsHide
    Hostname
    bybit24.com
    First seen
    2026-10-30 20:11 UTC
    First published
    2026-10-30 20:43 UTC
    DNS
    Resolves · checked 2026-11-04 20:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-30 19:07 UTC to 2027-01-28 19:07 UTC
    Logged 2026-10-30 20:06 UTC in DigiCert Sphinx2027h1, entry 318,922,334
    SHA-256 2c11b8eb4484d6499351b02792e1921cd17a786d0f7dcb1c2125d978d7eea09a
    Public key SHA-256 a01ca6d4fc3366e73cb904fb535b0ab26ab55ed5c1cd7fc626da96b939ab947c
    Brand
    Bybit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    bybit24.com
    Registered
    2024-03-21 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 22:18 UTC

    Suggest a correction

  21. bybit-wallet.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedParking page · AfternicListed by MetaMaskMX absentSPF -allDMARC missingRegistered 8 d ago
    DetailsHide
    Hostname
    bybit-wallet.com
    First seen
    2026-10-30 11:41 UTC
    First published
    2026-10-30 11:47 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-30 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:51 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by GoDaddy TLS Intermediate CA DV - R1v1
    Valid 2026-10-29 21:20 UTC to 2027-05-15 21:20 UTC
    Logged 2026-10-29 21:20 UTC in GoDaddy Aquamarine2027h1, entry 166,061,778
    SHA-256 053e68ff53f0c6a6b7e38d8984d5eaf498b0dec1db473b2a7b4c598d13b79061
    Public key SHA-256 07686e937c06f712a06839698842202ae0ba8361d6f1338fbf44490e0097452b
    Brand
    Bybit
    Addresses
    13.248.169.48 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    76.223.54.146 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Afternic (parking page)
    Parking page · Afternic
    The registry delegates bybit-wallet.com to Afternic’s nameservers, which answer for it. Afternic (13.248.169.48, 76.223.54.146): a parking service. It answers for names that are typically for sale or unused.
    Domain
    bybit-wallet.com
    Registered
    2026-10-28 · Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn)
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  22. www.bybitclaim.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 17 mo ago
    DetailsHide
    Hostname
    www.bybitclaim.com
    First seen
    2026-10-30 11:16 UTC
    First published
    2026-10-30 11:47 UTC
    DNS
    Resolves · checked 2026-11-04 11:51 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 10:07 UTC to 2027-01-28 10:07 UTC
    Logged 2026-10-30 11:05 UTC in Google PlumbersArms2027h1, entry 522,137,469
    SHA-256 5dc963c79a821c980628c691606650f50dcfa3b2b8e26b43cf6366775a58d5cb
    Public key SHA-256 82350ec96e9a1f4f8d7957b3b6be9f76dec11186127d05f3b5bb43a9f7bc01aa
    Brand
    Bybit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    bybitclaim.com
    Registered
    2025-06-13 · Realtime Register B.V.
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  23. bybitclaim.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 17 mo ago
    DetailsHide
    Hostname
    bybitclaim.com
    First seen
    2026-10-30 11:14 UTC
    First published
    2026-10-30 11:47 UTC
    DNS
    Resolves · checked 2026-11-04 11:51 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 10:07 UTC to 2027-01-28 10:07 UTC
    Logged 2026-10-30 11:05 UTC in Google PlumbersArms2027h1, entry 522,137,469
    SHA-256 5dc963c79a821c980628c691606650f50dcfa3b2b8e26b43cf6366775a58d5cb
    Public key SHA-256 82350ec96e9a1f4f8d7957b3b6be9f76dec11186127d05f3b5bb43a9f7bc01aa
    Brand
    Bybit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    bybitclaim.com
    Registered
    2025-06-13 · Realtime Register B.V.
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  24. www.bybit.org.in CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 7 d ago
    DetailsHide
    Hostname
    www.bybit.org.in
    First seen
    2026-10-29 23:11 UTC
    First published
    2026-10-29 23:44 UTC
    DNS
    Resolves · checked 2026-11-04 23:53 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-29 22:07 UTC to 2027-01-27 22:07 UTC
    Logged 2026-10-29 23:06 UTC in Google ParcelYard2027h1, entry 513,124,679
    SHA-256 4f225fd413e146c1fe36fe4697e4f1e7bb4dd5d07f54f10c79abf85a6df8ebbd
    Public key SHA-256 5d7295e5cbefe77dee95075a925273498e860eb7b7f372e1b23f7e2482975d0b
    Brand
    Bybit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    bybit.org.in
    Registered
    2026-10-29 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 01:42 UTC

    Suggest a correction

  25. bybit.org.in CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 7 d ago
    DetailsHide
    Hostname
    bybit.org.in
    First seen
    2026-10-29 23:11 UTC
    First published
    2026-10-29 23:44 UTC
    DNS
    Resolves · checked 2026-11-04 23:53 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-29 22:07 UTC to 2027-01-27 22:07 UTC
    Logged 2026-10-29 23:06 UTC in Google ParcelYard2027h1, entry 513,124,679
    SHA-256 4f225fd413e146c1fe36fe4697e4f1e7bb4dd5d07f54f10c79abf85a6df8ebbd
    Public key SHA-256 5d7295e5cbefe77dee95075a925273498e860eb7b7f372e1b23f7e2482975d0b
    Brand
    Bybit
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    bybit.org.in
    Registered
    2026-10-29 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 01:42 UTC

    Suggest a correction

  26. bybit.ai.in US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    bybit.ai.in
    First seen
    2026-10-28 17:41 UTC
    First published
    2026-10-28 18:18 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:30 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-28 17:26 UTC to 2027-01-23 09:49 UTC
    Logged 2026-10-28 17:36 UTC in DigiCert Sphinx2027h1, entry 296,934,946
    SHA-256 365d0de0f286529912b0a04dac28244d0a24116eb641d0b9357826330b4cef90
    Public key SHA-256 1a86a4c4147c07f2d19cff74e86ee3d9952b7529a0c9b22911f498502da5931b
    PhishDestroy
    Brand
    Bybit
    Addresses
    104.21.59.9 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.167.100 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:3b09
    2606:4700:3036::ac43:a764
    Cloudflare
    Cloudflare (104.21.59.9, 172.67.167.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bybit.ai.in
    Registered
    2026-04-06 · Dynadot, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  27. bybiteu.de PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC reject
    DetailsHide
    Hostname
    bybiteu.de
    First seen
    2026-10-28 10:37 UTC
    First published
    2026-10-28 11:02 UTC
    DNS
    Resolves · checked 2026-11-04 11:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-28 09:34 UTC to 2027-01-26 09:34 UTC
    Logged 2026-10-28 10:33 UTC in Let's Encrypt Sycamore2027h1, entry 818,689,325
    SHA-256 d01ec8731dab7a9d0b688551bda8949ce0e08c31f1eeae10ee85356cd0a1f56a
    Public key SHA-256 152a42c03c71e0aa4ecf5abf29f3baf08dfa7570353d100bd490db3e664fce5a
    Brand
    Bybit
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    bybiteu.de
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 14:35 UTC

    Suggest a correction

  28. www.techsupport-bybit.com RU · AS198610 · BEGET-AS Beget LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantineRegistered 17 mo ago
    DetailsHide
    Hostname
    www.techsupport-bybit.com
    First seen
    2026-10-28 06:36 UTC
    First published
    2026-10-28 06:38 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.130.41.168.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.130.41.168
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-28 05:32 UTC to 2027-01-26 05:32 UTC
    Logged 2026-10-28 06:31 UTC in Let's Encrypt Sycamore2027h1, entry 815,640,678
    SHA-256 0ef4bfa32277499b6b430849d56e6c862e024217a26838818757e058287e0c12
    Public key SHA-256 e3df9c351a021f018d516ee1633ae68cdbb309601db53029e36369ab46f8716b
    Brand
    Bybit
    Addresses
    45.130.41.168 · Russia · AS198610 BEGET-AS Beget LLC
    Domain
    techsupport-bybit.com
    Registered
    2025-06-27 · Beget LLC
    MX
    Receives mail at mail.techsupport-bybit.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  29. techsupport-bybit.com RU · AS198610 · BEGET-AS Beget LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantineRegistered 17 mo ago
    DetailsHide
    Hostname
    techsupport-bybit.com
    First seen
    2026-10-28 06:36 UTC
    First published
    2026-10-28 06:38 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.130.41.168.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.130.41.168
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-28 05:32 UTC to 2027-01-26 05:32 UTC
    Logged 2026-10-28 06:31 UTC in Let's Encrypt Sycamore2027h1, entry 815,640,678
    SHA-256 0ef4bfa32277499b6b430849d56e6c862e024217a26838818757e058287e0c12
    Public key SHA-256 e3df9c351a021f018d516ee1633ae68cdbb309601db53029e36369ab46f8716b
    Brand
    Bybit
    Addresses
    45.130.41.168 · Russia · AS198610 BEGET-AS Beget LLC
    Domain
    techsupport-bybit.com
    Registered
    2025-06-27 · Beget LLC
    MX
    Receives mail at mail.techsupport-bybit.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  30. no-reply-suport-bybit.com MD · AS200019 · AlexHost ALEXHOST S.R.L.
    ListedListed by MetaMaskMX absentSPF ~allDMARC missingRegistered 34 d ago
    DetailsHide
    Hostname
    no-reply-suport-bybit.com
    First seen
    2026-10-27 22:11 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-27 21:10 UTC to 2027-01-25 21:10 UTC
    Logged 2026-10-27 22:09 UTC in Google ParcelYard2027h1, entry 478,298,896
    SHA-256 35e486efe1dc7ee44d5c605c2085fca9d4c010f5b0bcc632b587a9ecbbd4d5b9
    Public key SHA-256 5493f813eae25492d5ecca2801770a5f65a306bbd7ff22a1c6282050fe6423b5
    Brand
    Bybit
    Addresses
    176.123.0.55 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    no-reply-suport-bybit.com
    Registered
    2026-10-02 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

  31. bybit-scan.cc GB · AS215540 · GCS-AS GLOBAL CONNECTIVITY …
    ReportedPhishing hostReported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    bybit-scan.cc
    First seen
    2026-10-27 21:26 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.138.90.227.
    1. Phishing-host list fetched with the address
    2. Resolved to 185.138.90.227
    3. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-27 20:23 UTC to 2027-01-25 21:21 UTC
    Logged 2026-10-27 21:23 UTC in IPng Networks Halloumi2027h1, entry 281,113,657
    SHA-256 6b39c218017d14800a0b1f5ab7d8df221985b08100503f3239d8d11867a37ea9
    Public key SHA-256 a4206e1c4758604162281c58b79bd5e4cb5a828b5bd22f46c0361d18eea52801
    PhishDestroy
    Brand
    Bybit
    Addresses
    185.138.90.227 · United Kingdom · AS215540 GCS-AS GLOBAL CONNECTIVITY SOLUTIONS LLP
    Domain
    bybit-scan.cc
    Registered
    2026-01-05 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

  32. bybit.tj US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF -allDMARC reject
    DetailsHide
    Hostname
    bybit.tj
    First seen
    2026-10-27 19:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 18:16 UTC to 2027-01-25 18:16 UTC
    Logged 2026-10-27 19:14 UTC in Google PlumbersArms2027h1, entry 476,952,764
    SHA-256 56ff58f69dc73e2c12d10435cc10b4d65b3b03d3320493d685226536263fbb45
    Public key SHA-256 c04fd22f8fb9eb31c18d6f471bb5ef0d11838a43e5c9a396f11282fa5ccfb342
    Brand
    Bybit
    Addresses
    104.21.72.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:b2c1
    2606:4700:3034::6815:4858
    Cloudflare
    Cloudflare (104.21.72.88, 172.67.178.193): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bybit.tj
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 08:33 UTC

    Suggest a correction

  33. www.bybit.tj US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder bybit.tj, listed by MetaMaskMX absentSPF -allDMARC reject
    DetailsHide
    Hostname
    www.bybit.tj
    First seen
    2026-10-27 19:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask, listing bybit.tj and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 18:16 UTC to 2027-01-25 18:16 UTC
    Logged 2026-10-27 19:14 UTC in Google PlumbersArms2027h1, entry 476,952,764
    SHA-256 56ff58f69dc73e2c12d10435cc10b4d65b3b03d3320493d685226536263fbb45
    Public key SHA-256 c04fd22f8fb9eb31c18d6f471bb5ef0d11838a43e5c9a396f11282fa5ccfb342
    Brand
    Bybit
    Addresses
    104.21.72.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.193 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:b2c1
    2606:4700:3034::6815:4858
    Cloudflare
    Cloudflare (104.21.72.88, 172.67.178.193): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bybit.tj
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 08:33 UTC

    Suggest a correction

  34. bybit.casa US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    bybit.casa
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Certificate logged in CT
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-30 01:42 UTC to 2027-01-25 09:15 UTC
    Logged 2026-10-30 01:52 UTC in DigiCert Wyvern2027h1, entry 354,772,575
    SHA-256 79ef25265e1c8460c69a8d042de8a5e6e0d78ddad65adbbf4a8511362fac6321
    Public key SHA-256 65b6a1e042a39bea4e3bfd144e144895cbea164ae18ece015499d56097946a84
    Brand
    Bybit
    Addresses
    104.21.43.217 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.236 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:2bd9
    2606:4700:3035::ac43:b9ec
    Cloudflare
    Cloudflare (104.21.43.217, 172.67.185.236): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bybit.casa
    Registered
    2026-06-28 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:28 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Bybit when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →