bitcoinvvn[.]io

This domain, bitcoinvvn.io, is actively flagged as a high-risk cryptocurrency phishing site targeting users of the 1inch decentralized exchange. Registered on November 13, 2025, through NiceNIC International Group Co., Limited, the domain resolves to 188.114.97.3, hosted on Cloudflare infrastructure (AS13335). Analysis indicates the site presents itself as a cryptocurrency exchange, with the page title 'Instant Bitcoin & Cryptocurrency Exchange in Vietnam - BitcoinVN,' though no direct affiliation with the legitimate BitcoinVN service is confirmed. The domain currently returns an HTTP 302 redirect status, suggesting it may be part of a larger redirection chain or awaiting activation for malicious use. Security vendors have detected this domain as malicious, with 11 of 95 engines on VirusTotal flagging it at the time of analysis. It appears on four security blocklists and is actively blocked by multiple cryptocurrency-focused security tools, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. Infrastructure analysis reveals the domain uses Cloudflare nameservers (armando.ns.cloudflare.com and vivienne.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The registration age (eight months) and use of a privacy-protected registrar further align with patterns observed in phishing operations. Defenders should treat this domain as actively malicious, prioritize blocking it at the network and endpoint levels, and monitor for related infrastructure leveraging the same registrar or hosting provider. No additional details about the phishing kit or exact attack methodology are available at this time.