bitvavo-id[.]nl

The domain bitvavo-id.nl is a confirmed phishing site engaged in brand impersonation targeting cryptocurrency users. It mimics the Coinbase platform to deceive victims into submitting sensitive information under the guise of 'ID-verificatie (KYC)', a common tactic in cryptocurrency scams. No drainer kit was identified, but the site was actively used for credential theft before being taken offline.

Technical indicators confirm the malicious nature of bitvavo-id.nl. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including Bfore.Ai PreCrime and Gridinsoft, which assigned a trust score of 0/100. The domain was created on February 21, 2026, and resolved to the IP address 172.67.158.78, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate was issued by WE1, a low-assurance provider. It appeared on one security blocklist (PhishDestroy) and was referenced in one AlienVault OTX threat intelligence pulse. Scamadviser assigned a trust score of 1/100, further indicating its fraudulent purpose.

Victims who interacted with bitvavo-id.nl should immediately change passwords for any accounts accessed via the site, particularly cryptocurrency exchange credentials. Enable two-factor authentication (2FA) on all financial and email accounts to prevent unauthorized access. Monitor accounts for suspicious transactions and report any fraudulent activity to the impersonated brand, Coinbase. The domain can be reported to Google Safe Browsing, PhishTank, or local cybercrime authorities for further investigation and takedown efforts.