dsfs36.it scam: the dead domain and the network still live

A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from queries to the domain name servers carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.

Anyone trying to open dsfs36.it today finds nothing. The name does not resolve: the browser returns an error, as though the site had never existed. It is the moment at which almost every injured party gives up, because it looks like final proof that there is nothing left to be done.

The opposite is true, and this article explains why.

dsfs36.it is a scam, our firm has already handled this case, and the fact that the domain has been switched off does not erase the organisation behind it. On the contrary: right now, while dsfs36.it no longer exists, seven twin domains of the same series are still active, resting on exactly the same infrastructure. Whoever defrauded people that way has not retired: they have changed the number plate.

Why dsfs36.it is a scam: the series of domains

Let us start with the technical fact, which anybody can verify.

dsfs36.it belongs to a family of names recognisable at a glance: a few meaningless letters followed by a number, all registered in the Italian top-level domain. These are not names chosen to be remembered — they are serial codes, disposable, designed to last a few weeks and then be abandoned.

By querying the name servers we verified that, as at the date of publication:

dsfs36.it no longer resolves, and neither does dtw866.it, another name of the same series already dealt with by the firm in a different file.

Still active today, however, are dfgr269.it, mg6228.it, ht6953.it, bgdd66.it, sd3257.it, fgre369.it and zs8596.it.

And here comes the point that really matters. All seven of these domains are delegated to the same identical pair of name servers — the "harvey" and "wally" pair of the network service that fronts them.

It is worth explaining properly why this is a serious element and not a coincidence, because the whole difference lies here. The server's numeric address proves nothing: that kind of service routes millions of different sites through the same addresses, and finding two sites on the same IP address means nothing at all. The pair of name servers, on the other hand, is assigned to the individual account when the account is created, and stays the same for every domain that account manages. Two domains with the same pair, chosen from a great many possible ones, are with very high probability in the same account.

Seven domains of the same series, with the same pair, all used for the same scheme. dsfs36.it was not an isolated site: it was one of the shop windows of a single structure, and the other windows are still lit.

Why the fact that dsfs36.it is an .it domain is good news

There is a second element which, in the dsfs36.it case, works in the injured party's favour, and it is an element that is usually missing altogether.

Names like dsfs36.it sit in the Italian top-level domain, assigned by an Italian public registry. This means three very concrete things.

First: the data of whoever applied for registration are kept in Italy, by an Italian body, and can be obtained by the Italian judicial authority without letters rogatory, European investigation orders or requests to foreign platforms that can take months — when they answer at all. Compared with a generic domain registered abroad behind an anonymisation service, the distance between the prosecutor and the data is incomparably shorter.

Second: the assignment rules require the data declared to be true and up to date. Whoever registers a name like dsfs36.it in order to commit fraud either declares false data — and then the falsity is itself an element of an offence and a breach of contract — or declares true data, in which case those data lead to somebody. Even registration in a front man's name is an investigative starting point, not a wall.

Third: alongside the criminal proceedings there is an administrative route, provided for by the registry's own rules, that allows a domain name used unlawfully to be reported and challenged. It is a parallel path, far quicker than a trial, which can lead to the name being deactivated and which is worth pursuing for the domains of the series that are still active.

The scheme: fake work and fake trading

In the dsfs36.it file the scheme is the now recurrent one that combines fake employment with fake investment.

It starts with an offer of work from home, simple, with small tasks to complete. The first payments really do arrive: small sums credited, just to show that "the system pays". Then the mechanism changes: to unlock the next task, or to reach the level that pays more, you have to top up. From then on it is only money going out, and the "trading" component serves to justify, with charts and balances that grow, why it is worth continuing to pay.

In the dsfs36.it case the injured party paid in roughly eight thousand euro in total, by direct bank transfers to Italian accounts.

One important thing must be said about this, because most injured parties do not know it: the fact that the transfers went to Italian accounts is the most favourable element in the whole file. There is no foreign platform to chase, no exchange based in a country that does not cooperate. There are Italian current accounts, held by somebody, at Italian institutions subject to anti-money-laundering rules and reachable with a prosecutor's order within a short time. The holders of those accounts are almost always front men, but they are identifiable front men, and the path of the money after the first step can be reconstructed.

The sums received into the account

One element of the dsfs36.it file deserves a separate warning, because it concerns a great many people who have no idea they have a problem.

During the affair, sums arrived in the injured party's account, presented as rewards or earnings accrued.

Anyone who receives money from strangers in the context of an online scam should know that, in the vast majority of cases, those sums come from other injured parties. It is money of unlawful origin that the organisation passes through a clean account in order to break the audit trail.

The practical rule is one and it is simple: they must be declared first, in the document filed, with date, amount and ordering party, attaching the bank advices. They must not be left out because "they complicate things": left out, one day they will look concealed; declared spontaneously, they become at once the proof of good faith and a valuable investigative element, because they connect the file to that of another injured party. Money laundering under article 648-bis of the Italian criminal code requires intent, that is, awareness of the unlawful origin, and somebody who was deceived does not have it: but awareness has to be demonstrated through the facts, and the way to demonstrate it is to declare everything before somebody else asks.

"I already filed a complaint and never heard anything again"

In the dsfs36.it case the injured party had already filed a complaint. Two pages, dictated to the Carabinieri, against persons unknown. Since then, no news.

This is not an isolated case: it is the ordinary outcome. A complaint against persons unknown that recounts the facts without reconstructing the path of the money and without formulating specific requests leaves the prosecutor with no point from which to start, and the file heads for closure.

There is, however, one step that almost nobody knows about and that changes the situation. Whoever files can expressly ask to be informed of any request for the case to be closed, under article 408 paragraph 2 of the code of criminal procedure. If that declaration is missing, closure can be ordered without the injured party knowing. And that is exactly what happens in most cases like dsfs36.it.

If you are in this situation, you are not out of time. This is how to proceed.

First you ask the prosecutor's office, under article 335 of the code of criminal procedure, for the number and status of the proceedings: that tells you whether the file is still open, whether it has been closed and when.

If it has been closed, closure is not an acquittal and is not final. Article 414 allows the reopening of the investigation where the need for new investigative steps emerges. And in the dsfs36.it case that need concretely exists: the twin domains still active, the identical scheme documented in other files, the other pending proceedings on the same structures are all new elements compared with a two-page complaint from 2025.

If instead the file is still open, a supplementary filing is made that does what the original complaint did not: it reconstructs the flow of money account by account, asks for the sums to be seized, asks that the investigation not stop at the first step, and asks for the proceedings to be joined with those concerning the domains of the same series.

Is there still time? Prosecutability

It is the question anyone who suffered the dsfs36.it scam in 2025 asks.

Simple fraud is prosecutable on complaint within three months of learning of the facts, and for facts dating from 2025 that time limit expired long ago. But that is not the point, because in cases like dsfs36.it the aggravating circumstances change the regime.

Article 640 paragraph 2-ter of the criminal code, introduced by law 90/2024 and in force since July 2024, aggravates fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator: it applies to facts from 2025. Alongside it, depending on the case, come diminished defence under article 61 no. 5 recalled by article 640 paragraph 2 no. 2-bis, and damage of particular seriousness under article 61 no. 7.

The aggravating circumstances of the second paragraph of article 640 entail prosecution of the court's own motion. And prosecutable of the court's own motion is also unauthorised financial activity under article 166 of the Consolidated Law on Finance, which applies where somebody collects money presenting it as an investment without any authorisation — exactly what dsfs36.it was doing.

In plain words: the time limit for a simple complaint may have expired, but the proceedings are not barred. And the limitation period for aggravated fraud is measured in years, not months.

What to secure, even after time has passed

Anyone who paid money to dsfs36.it should obtain from their bank the complete list of operations, outgoing and incoming, with ordering party, beneficiary, IBAN, BIC, country and payment reference. The conversations, exported in native format and not photographed. The telephone numbers and addresses used by the self-styled operators. The screenshots of the platform, if any remain. A copy of the complaint already filed and of any filing receipt. And the exact address of the domain, even though it no longer answers today: the name remains the identifier through which the file links up with the others.

One final warning, which always applies: if somebody contacts you saying they can recover those sums on advance payment of commissions, taxes or unlocking fees, that is the second scam, built on the lists of the victims of the first.

Similar cases already handled by the firm

Anyone who crossed paths with dsfs36.it will find our analysis of the other domains in the same series useful: dfgr269.it, where the network of domains is reconstructed in full, mg6228.it, on the mechanism of the first successful withdrawal, and dtw866.it, on fake work with prepaid orders. On blocked balances and fake tasks, cryptoledgerx.top is also useful. On the phase after the complaint, with opposition to closure, see the tiaozhuang12.top case.

If you paid money to dsfs36.it: what to do now

This is the picture. dsfs36.it is a scam: a serial domain name, switched off today, which was part of a series of .it names managed by a single structure, seven of which are still active as we write and all delegated to the same pair of name servers.

A switched-off site is not the end of the story. The transfers went to Italian accounts, the .it domain registry is Italian, and the other domains in the series are alive and documentable today.

If you have already filed a complaint and never heard anything again, the first thing to do is not to resign yourself: it is to ask for the status of the proceedings and consider a filing that asks for what the complaint did not.

Our firm has already handled this case. You can submit your position to us for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.