bitvovip[.]vip

This domain, bitvovip.vip, is assessed as a high-risk phishing site specifically designed to impersonate the Bitvavo cryptocurrency exchange platform. Analysis indicates the site functions as a credential harvester and potential crypto drainer, targeting users through fake login portals to steal authentication details and digital assets. The page title explicitly mimics Bitvavo, reinforcing the brand impersonation tactic employed by the threat actors. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain resolves to IP address 118.193.77.32 and was registered on December 8, 2025, through registrar Gname.com Pte. Ltd. Security vendors on VirusTotal flagged the domain with 12 out of 95 detections, while three independent blocklists have listed it as malicious. Additional protections include blocking by browser-based security extensions and a Gridinsoft trust score of 0 out of 100. Detected technologies include Nginx as the web server and HTTP Strict Transport Security (HSTS) implementation, which may be leveraged to enhance the illusion of legitimacy. Mitigation measures should focus on preventing user exposure to the threat. Network-level blocking of the domain and associated IP address 118.193.77.32 is recommended for enterprise environments. End users should be alerted to verify domain authenticity before entering credentials, particularly on cryptocurrency platforms, and should enable multi-factor authentication (MFA) on all financial accounts. Security teams are advised to monitor for related domains registered through Gname.com Pte. Ltd. that may exhibit similar naming patterns or infrastructure characteristics. Immediate reporting to relevant financial and cybersecurity authorities is encouraged to support takedown efforts.