bgdd66.it scam: why they move you to another site

A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from queries to the domain name servers carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.

At a certain point a message arrives that looks like a technical detail. "The platform is being upgraded." "We are migrating to the new system." "From today, use this address." They send you a new link, you register again, and the balance you saw before reappears there, the same or even higher.

It looks like maintenance. It is a hand-over, and it is designed.

bgdd66.it is a scam, our firm has already handled this case, and this article explains why the victim is moved from one site to another, what that transfer is meant to achieve, and why the message announcing it is the best piece of evidence you have.

Why bgdd66.it is a scam: not a site, a shift

Let us start with the technical check, which anybody can repeat.

bgdd66.it belongs to a family of names recognisable at a glance: two or three meaningless letters followed by a number, all in the Italian top-level domain. They are not names meant to be remembered: they are temporary number plates.

By querying the name servers we verified that, as at the date of publication, bgdd66.it, ht6953.it, sd3257.it, dfgr269.it, mg6228.it, fgre369.it and zs8596.it are active, while two other names of the same series — dsfs36.it and dtw866.it, both the subject of other files of the firm — no longer resolve.

All seven active domains, bgdd66.it included, are delegated to the same identical pair of name servers. That carries weight, because the pair is assigned to the individual account when the account is created and stays the same for every domain that account manages. Tellingly, bgdd66.it answers on different numeric addresses from other domains in the series: confirmation that what holds them together is not the server but the account that administers them.

But the bgdd66.it file contains something stronger than a technical indication: the same injured party was taken, within the same affair, onto three domains of the series — ht6953.it, bgdd66.it and sd3257.it. The link does not have to be inferred: it was lived.

As for the substantive checks, behind bgdd66.it there is no identifiable company, no VAT number, no registered office and no authorisation number. Anyone collecting money presenting it as an investment must be authorised and entered in the relevant registers, and that authorisation is verified on the supervisory authority's register.

Why they move you: four reasons, all to their advantage

The transfer from one address to another is not disorganisation. It serves four precise purposes, and knowing them helps you recognise the mechanism while it is happening.

First: the balance gets rewritten. The number you see on bgdd66.it is not an accounting record: it is text on a page. By moving you, whoever runs the site decides from scratch what to show you, and usually shows more than before. It is the move that makes stopping psychologically impossible: stopping now would mean giving up a figure that on screen is larger than what you paid in.

Second: the evidence gets fragmented. People who file a complaint usually report the site they were on at the end. Payments made on the first address stay out, so do the early conversations, and the file is born maimed. Three sites told as three separate episodes are worth far less than one affair told in full.

Third: the burnt domain gets abandoned. When a name starts appearing in reports, it is left to die and replaced. That is exactly what happened to the two names of the series that no longer resolve.

Fourth, and most insidious: the checks get reset. A domain registered a few weeks ago has no reviews, no reports, nothing. If you search bgdd66.it and find nothing, the instinct is to read that as reassurance. It is the opposite: on a site you are entrusting money to, finding nothing is a negative signal, not a neutral one. A real financial platform leaves traces — a company record, a VAT number, an authorisation number, customers who talk about it. The void is the product of the domain's youth, and it is deliberate.

The evidence almost everybody throws away

Here is the most important thing in this article.

The message telling you about the switch from one address to another — "from tomorrow use bgdd66.it", "the old site is no longer active", "register here with the same credentials" — is the best evidence in the whole file.

The reason is simple: it shows, from the inside, that the two sites are run by the same people. Without that message, the link between domains has to be built with technical arguments, which are valid but indirect. With that message, the link is declared by them.

For this reason it must be treated as a document: exported in native format, with date and time, using the chat's own export function — not photographed with another phone, not cropped. And the messages explaining why the balance looked different after the move should be kept too, because they document the manipulation of the figure.

Alongside the message you need a chronology: for each address, from when to when it was used, and with which payments. Three well-written lines are worth ten pages of narration.

The scheme: from fake work to fake trading

For completeness, in the bgdd66.it file the contact does not begin with an investment proposal but with a fake job: liking videos, small tasks, a small payment that really does arrive.

It serves to show that "the system pays". Then, to reach the level that pays more, you have to top up; the fake job becomes fake trading; and the money starts travelling in one direction only. The total sum, in this case, is around six thousand five hundred euro, with payments up to October 2026 made by Italian bank transfers to the account of a natural person.

On this last point the usual warning applies: the holder of that account is almost always a front man, and is the starting point of the investigation — but must not be contacted. It recovers nothing, it puts them on alert, and it exposes you.

The legal framework: one course of conduct, not three

This is where the way the filing is drafted makes the difference.

The facts date from October 2026, and therefore come after law 90/2024: article 640 paragraph 2-ter of the criminal code applies, which aggravates fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator. Alongside it come diminished defence under article 61 no. 5, recalled by article 640 paragraph 2 no. 2-bis, and damage of particular seriousness under article 61 no. 7, to be assessed on the facts. Unauthorised financial activity under article 166 of the Consolidated Law on Finance is also relevant, prosecutable of the court's own motion, and, as regards the money, money laundering under article 648-bis for whoever moved the sums after they were credited.

But the specific point of a case like bgdd66.it is another: the passage across several domains must not be presented as a series of unconnected episodes. It is a single course of conduct, carried out in execution of one and the same criminal design under article 81 of the criminal code, and it must be described as such. The coordinated plurality of domains, telephone numbers and accounts is moreover the element on which an allegation of an organised structure, rather than of a single fraudster, rests.

The practical consequence: the filing must identify all the addresses, with their respective dates, expressly asking for the proceedings to be linked with those concerning the other domains of the same series.

On the time limit: with the last payment in October 2026, the three-month complaint deadline falls in January 2027. The aggravating circumstances of the second paragraph of article 640 entail prosecution of the court's own motion in any event, but it is not worth waiting: the domains of the series are alive now, and the data concerning them can be obtained for as long as they exist.

What to secure immediately

Anyone who paid money to bgdd66.it must obtain: the complete bank statement in official form, outgoing and incoming, with all the beneficiaries' details; the native export of the conversations, starting with the messages announcing the changes of address; the chronology of the domains used, with dates; the numbers and profiles of the self-styled operators; the screenshots of each platform, noting which address they refer to; and the list of personal data provided.

And the warning that always applies: anyone who contacts you promising to recover the sums on advance payment is the second scam, built on the lists of the victims of the first.

Similar cases already handled by the firm

Anyone who crossed paths with bgdd66.it will find useful our analysis of the other domains of the same series: ht6953.it, on the first address of the same affair and on how to draft the complaint, dfgr269.it, where the network of domains is reconstructed in full, mg6228.it, on the mechanism of the first successful withdrawal, dsfs36.it, on the dead domain while the network stays live, and dtw866.it, on the fake job with video likes. On blocked balances, cryptoledgerx.top is useful; on the phase after filing, see tiaozhuang12.top.

If you paid money to bgdd66.it: what to do now

This is the picture. bgdd66.it is a scam: a serial .it domain, active as we write, which shares its pair of name servers with six other names of the same family even though it answers on different numeric addresses, and which in the same affair was both preceded and followed by two other addresses of the series.

If they moved you from one site to another, do not tell it as a detail: it is the heart of the affair. Reconstruct the chronology, keep the message that announced the move, and make sure the filing covers all the addresses and not only the last one.

Our firm has already handled this case. You can submit your position to us for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.