bitvavoxso[.]top

This domain, bitvavoxso.top, was identified as a brand impersonation phishing site targeting Bitvavo, a cryptocurrency exchange platform. Registered on February 21, 2026, through Dynadot LLC, the domain resolved to the IP address 182.16.10.131, hosted under AS45753 (Netsec Limited) in Hong Kong. The nameservers were configured as ns1.dyna-ns.net and ns2.dyna-ns.net. Analysis of the domain's infrastructure reveals it lacked an SSL certificate, increasing the risk of unencrypted data interception. The page title, 'Bitvavo,' aligns with the impersonated brand, though the exact content and functionality of the site remain unconfirmed due to its current offline status.

Security vendors flagged the domain for social engineering risks, with Google Safe Browsing categorizing it as such. PhishDestroy blocked access to the domain, and it appeared on at least one security blocklist. While three of 95 security vendors on VirusTotal detected the domain as malicious, the absence of broader detection does not confirm its safety. The domain's hosting provider and registration details suggest a deliberate setup to mimic legitimate Bitvavo infrastructure, though no evidence links it to a specific phishing kit or campaign.

Defenders should treat this domain as high-risk for cryptocurrency-related fraud, particularly given its association with a known exchange brand. Monitoring for re-activation or similar domains under the same registrar or hosting provider is recommended. Network-level blocking of the IP 182.16.10.131 may mitigate residual risk, though defenders should verify its continued association with malicious activity before implementing long-term controls. No additional evidence of compromise or victim reports is currently available.