dvo-us[.]com

Analysis indicates that dvo-us.com was associated with a generic_phishing operation consistent with a fake login campaign. The observed page title, "Bitvavo", suggests the site presented itself as a recognizable login destination in an effort to capture user credentials or other sensitive authentication data. Although the domain has been taken offline, previously active phishing infrastructure can continue to present residual risk if harvested credentials remain valid or if the infrastructure is later re-established elsewhere. The presence of an SSL certificate identified as R12 indicates encrypted transport was available during operation, but this should not be interpreted as evidence of legitimacy.

Technical indicators support the elevated risk assessment. VirusTotal reports that 19 out of 95 security vendors flag the domain as malicious. The domain resolves to IP address 52.28.67.255, which is located in DE within AS16509 Amazon.com, Inc. Domain registration records show a creation date of March 10, 2026. The domain appears on 1 security blocklist and has been blocked by PhishDestroy. No verified information regarding Google Safe Browsing status is available from the supplied intelligence and therefore no conclusion can be drawn on that specific indicator. Collectively, the detection rate, recent registration, hosting information, and blocklist inclusion provide consistent evidence supporting classification as phishing infrastructure.

The domain is currently offline, reducing the immediate likelihood of additional victim interaction through this specific address. However, offline status does not eliminate historical exposure risk or prevent similar infrastructure from reappearing under different domains. Any user who previously entered credentials or other confidential information through this site should treat those credentials as potentially compromised, change affected passwords immediately, review account activity for unauthorized access, and enable stronger authentication controls where available. Security teams should preserve relevant logs, search for historical connections to dvo-us.com and IP address 52.28.67.255, monitor for related indicators of compromise, and continue blocking the domain to reduce the chance of future access if the infrastructure becomes active again.