bitvavonvs[.]top

On July 24 2026 analysts observed that the domain bitvavonvs.top is hosted at IP 182.16.10.130, which resolves to Netsec Limited in Hong Kong (ASN 45753). The domain was registered on 21 February 2026 through Dynadot LLC and uses the authoritative name servers ns1.dyna‑ns.net. and ns2.dyna‑ns.net. No TLS certificate is presented, indicating the site was served over plain HTTP. The page title returned by the web server is “Bitvavo”, matching the declared brand target Bitvavo and confirming a brand‑impersonation intent.

Google Safe Browsing categorises the URL as a social‑engineering threat, and the domain appears on one external security blocklist. PhishDestroy has also recorded the site as blocked. VirusTotal scans reported 11 detections out of 95 antivirus engines, reinforcing the malicious classification. The domain is currently offline, but the infrastructure details remain useful for threat‑intel correlation. Defenders should continue to deny traffic to bitvavonvs.top and its resolved IP address, add the domain and IP to local and cloud‑based blocklists, and monitor for any future resurrection of the domain or usage of the same registrar and name‑server pair.

Ongoing observation of ASN 45753 activity is recommended, as the hosting provider has been associated with other fraudulent campaigns. Because the site presented no SSL certificate, any attempt to deliver credentials over an encrypted channel would be impossible, but the lack of TLS also makes the site easier to intercept. Organizations that use Bitvavo services should educate users about the absence of a valid certificate and the mismatch between the legitimate Bitvavo domain and this look‑alike. The evidence base currently consists of registrar data, DNS records, Safe Browsing and VirusTotal alerts; no additional payload or page‑content analysis is available.