bitvavo[.]com[.]nl[.]services[.]l46rqlmxutj18mnhbtcafqabattx5yxxmnyhaabxpwpguuegzzem[.]niyikolawole[.]com

The domain bitvavo.com.nl.services.l46rqlmxutj18mnhbtcafqabattx5yxxmnyhaabxpwpguuegzzem.niyikolawole.com was registered on September 19, 2025 through NameCheap, Inc. and is hosted on the IP address 162.215.15.12, which belongs to ASN46606 (Unified Layer) located in the United States. The authoritative name servers for the zone are ns1.netlightsystems.com and ns2.netlightsystems.com. No TLS certificate is presented for the host, indicating that the site would be served over plain HTTP if accessed. The page title returned by the server is "Bitvavo", directly matching the targeted brand, and the listed scam type is "Crypto Scam".

Gridinsoft’s trust scoring engine assigns a score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis reports that 15 of 95 scanned security engines flag the domain as malicious, and the domain is listed on a single external security blocklist. PhishDestroy has also added the host to its blocklist. The site is currently taken offline, and its status is recorded as offline.

The available evidence confirms a brand‑impersonation campaign aimed at Bitvavo users, leveraging a long, obfuscated sub‑domain to mimic legitimate URLs and potentially lure victims into cryptocurrency‑related fraud. Uncertainties remain regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the title has been publicly disclosed. Defenders should incorporate the domain and its IP address into sink‑hole or intrusion‑prevention rules, monitor NameCheap registrations for similar patterns, and continue to block traffic to the host at network perimeters. Ongoing threat‑intel feeds should be consulted for any re‑activation attempts, and affected Bitvavo users should be alerted to the impersonation risk despite the current offline status.