dvpxqhxtiw[.]btcrovellio[.]it

This domain is flagged as a high-risk brand impersonation threat designed to deceive users through fraudulent cryptocurrency trading schemes. Analysis indicates the page mimics the 'across' brand, presenting a fake automated crypto trading system labeled 'BTC +790 Belvario' to lure victims into interacting with malicious infrastructure. The intent appears to be financial fraud, likely involving crypto asset theft or unauthorized transactions under the guise of legitimate trading services.

Infrastructure analysis reveals the domain was registered on February 21, 2026, through Dynadot LLC, a registrar frequently abused for malicious campaigns. It resolves to IP address 172.67.167.150, hosted behind Cloudflare, which obscures origin servers and complicates takedown efforts. Security vendors flagged the domain in 12 out of 95 VirusTotal scans, while Gridinsoft assigned a trust score of 0/100. Google Safe Browsing classifies it under 'SOCIAL_ENGINEERING,' and it appears on three security blocklists. Additional protections include blocks by MetaMask, SEAL, and PhishDestroy, indicating broad recognition of its malicious nature. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting users.

Mitigation requires immediate blocking of the domain and associated IP across all network security controls. Organizations should update endpoint detection rules to flag the domain, page title ('BTC +790 Belvario — sistema di trading crypto automatizzato e sicuro'), and registrar (Dynadot LLC) as indicators of compromise. Users should be educated on recognizing brand impersonation tactics, particularly in cryptocurrency contexts, and instructed to verify domain authenticity through official channels before interacting with trading platforms. Financial institutions and crypto service providers should monitor for transactions linked to this domain and implement additional authentication steps for high-risk activities.