bitvavo[.]com[.]nl[.]services[.]cbz[.]poe[.]temporary[.]site

This domain, bitvavo.com.nl.services.cbz.poe.temporary.site, is identified as a brand impersonation threat targeting Bitvavo, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the legitimate Bitvavo brand, likely to deceive users into disclosing sensitive credentials or transferring cryptocurrency assets. The page title explicitly matches the legitimate service, reinforcing the impersonation tactic. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and content align with credential theft objectives. Technical indicators reveal the domain was registered through ENOM, INC. on August 04, 2023, and resolves to the IP address 108.167.181.248, hosted under AS19871 (Network Solutions, LLC) in the United States. The domain appears on 2 security blocklists and is flagged by 17 out of 95 security vendors on VirusTotal. An SSL certificate issued by Let's Encrypt (R13) was detected, which is commonly exploited in malicious campaigns to lend a false sense of legitimacy. The domain was also blocked by PhishDestroy and PhishingDB, further corroborating its malicious classification. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risks. However, the infrastructure supporting this campaign may remain active, and similar domains could emerge using comparable tactics. Organizations and users are advised to monitor for residual threats, particularly those targeting cryptocurrency platforms. Blocking the associated IP (108.167.181.248) and implementing domain-based filtering for newly registered lookalike domains are recommended mitigation steps. Continuous vigilance is required due to the persistent nature of brand impersonation threats in the cryptocurrency sector.