ht6953.it scam: three domains, one single structure

A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from queries to the domain name servers carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.

Normally, to show that two different sites belong to the same organisation, you have to compare the files of different people. In this case that was not necessary: the same injured party was moved across three addresses of the same series. ht6953.it, bgdd66.it and sd3257.it, one after the other, within the same affair.

It is the cleanest proof you can have, and it comes from inside a single file.

ht6953.it is a scam, our firm has already handled this case, and in this article we explain what it concretely means to have passed through three shop windows of a single structure — and how the complaint must be drafted so that this element is not lost.

Why ht6953.it is a scam: a series, not a site

Let us start with the technical check, which anybody can repeat.

ht6953.it belongs to a family of names recognisable at a glance: two or three meaningless letters followed by a number, all registered in the Italian top-level domain. They are not names designed to be remembered: they are serial codes, meant to last a few weeks and then be replaced.

By querying the name servers we verified that, as at the date of publication, ht6953.it, bgdd66.it, sd3257.it, dfgr269.it, mg6228.it, fgre369.it and zs8596.it are active, while two other names of the same series, dsfs36.it and dtw866.it — both the subject of other files of the firm — no longer resolve.

And all seven active domains, ht6953.it included, are delegated to the same identical pair of name servers.

It is worth explaining why this is a serious indication and not a coincidence. The numeric address a site answers on proves nothing: the network service used routes millions of different sites through the same addresses. The pair of name servers, on the other hand, is assigned to the individual account when it is created and stays the same for every domain that account manages. Two domains with the same pair, chosen from a great many possible ones, are with very high probability in the same account.

Here, though, we do not stop at the technical indication, because the file contains something stronger: the same person was led, within the same affair, onto three of those domains. The link between ht6953.it and the other two does not have to be inferred: it was lived, documented by the conversations and the payments.

As for the substantive checks, the result is the usual one: behind ht6953.it there is no identifiable company, no VAT number, no registered office and no authorisation number. Anyone collecting money presenting it as an investment must be authorised and entered in the relevant registers, and that authorisation is verified on the supervisory authority's register.

The scheme: from likes to trading

In the ht6953.it file the contact does not begin with an investment proposal. It begins with a fake job: liking videos, completing small tasks, receiving a small payment.

The first payments really do arrive. They serve to show that "the system works" and to build the trust needed for the next step, which is always the same: to reach the level that pays more you have to top up. At that point the fake job turns into fake trading, charts and growing balances appear, and the money starts travelling in one direction only.

In the ht6953.it case the total sum is around six thousand five hundred euro, paid up to October 2026.

The most important fact: the transfers went to a natural person

Here is the element that, from a recovery point of view, is worth more than all the rest.

The payments connected with ht6953.it were made by Italian bank transfers, and the beneficiary was not a foreign company or a platform: it was a natural person, with an account at an Italian institution.

This completely changes the scope of the action.

There is no foreign platform to trace, no exchange in a country that does not cooperate, no letters rogatory to set in motion. There is an Italian IBAN, in somebody's name, at an Italian bank subject to anti-money-laundering rules and reachable with a prosecutor's order within a short time. The account holder's identity follows from the IBAN; the subsequent movements on the account can be obtained; and the money, almost always, was moved immediately after it was credited.

Two clarifications are required, and both must be made.

The first: the holder of that account is, in the vast majority of cases, a front man — often someone who was deceived in turn, recruited with the promise of a job and persuaded to "lend their account". This does not make them irrelevant: they are the link from which the reconstruction starts, and whether they answer for money laundering under article 648-bis of the criminal code or are themselves an injured party is for the magistrate to assess.

The second, and it serves as a warning: do not contact them. Anyone who has suffered the fraud must not write to, telephone or turn up at the account holder's door. It recovers nothing, it puts them on alert, and it can expose whoever does it. The IBAN is filed; it is not used to take justice into one's own hands.

Have you not filed yet? Then read this part

In the ht6953.it file the complaint had not yet been filed when the case reached us. It is the best position to be in, because it allows the complaint to be written properly the first time — and over the following months the difference is enormous.

Here are the four things almost no complaint contains and which instead must be there.

The path of the money, not the narrative. Every payment must be set out with date, amount, ordering party, beneficiary, IBAN, BIC, country and payment reference, with the bank advices attached. Any sums received must be set out too. A list of operations is worth more than ten pages of narration: it is from there that the prosecutor can ask for a freeze.

All the domains, not just the last one. In the ht6953.it case the filing must identify the three addresses — ht6953.it, bgdd66.it and sd3257.it — with the dates on which each was used, and must set out that they belong to a series of names managed by the same structure, asking for the proceedings to be linked with the others concerning the same domains. That is how a six-thousand-euro file stops being an isolated case and becomes part of something the prosecutor has an interest in pursuing. In substantive terms this is a single continuing course of conduct, to be presented as such under article 81 of the criminal code.

The declaration that you wish to be informed. It is the line almost nobody writes and that later makes the difference: under article 408 paragraph 2 of the code of criminal procedure the injured party may expressly ask to be notified of any request for the case to be closed. Without that declaration, the proceedings can be closed without your knowing and without your being able to object. It should be accompanied by an election of domicile and the appointment of counsel.

The requests, not only the facts. Seizure of the sums, enquiries into the destination accounts and the subsequent steps, acquisition of the data held by the .it domain registry, joinder with connected proceedings. A complaint that merely recounts hands over a story; a complaint that asks hands over a map.

Two practical points: get the filing receipt and note the number of the proceedings; and hand over copies, keeping the originals and the devices.

The fact that the domains are .it is an advantage

One last technical element, which in the ht6953.it case works in your favour.

Names like ht6953.it sit in the Italian top-level domain, assigned by an Italian public registry. The data of whoever applied for registration are therefore kept in Italy, by an Italian body, and can be obtained by the Italian judicial authority without going through foreign platforms. The assignment rules also require the data declared to be true: if they are false, the falsity is itself relevant; if they are true, they lead to somebody.

Finally, there is an administrative route, provided for by the registry's rules, for reporting and challenging a domain name used unlawfully: it is a parallel path, quicker than a trial, and for the domains of the series that are still active it is worth pursuing.

The legal framework

The ht6953.it facts date from October 2026, and therefore come after law 90/2024: article 640 paragraph 2-ter of the criminal code applies, which aggravates fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator.

To this are added diminished defence under article 61 no. 5, recalled by article 640 paragraph 2 no. 2-bis, and damage of particular seriousness under article 61 no. 7, to be assessed on the facts. Unauthorised financial activity under article 166 of the Consolidated Law on Finance is relevant, prosecutable of the court's own motion. And, as regards the money, money laundering under article 648-bis for whoever moved the sums after they were credited.

The coordinated plurality of domains, telephone numbers and accounts is moreover an element that must be set out in the filing, because it is on that plurality that an allegation of an organised structure, rather than of a single fraudster, rests.

On the time limit: the last payment dates from October 2026, so the three-month complaint deadline falls in January 2027. The aggravating circumstances of the second paragraph of article 640 entail prosecution of the court's own motion in any event, but filing within the limit remains the sounder choice — and here there is one more reason not to wait: the domains of the series are alive now, and the data concerning them can be obtained for as long as they exist.

What to secure immediately

Anyone who paid money to ht6953.it must obtain the complete bank statement in official form, outgoing and incoming, with all the beneficiaries' details; the native export of all conversations, including those on the messaging applications used for recruitment; the numbers and profiles of the self-styled operators; the screenshots of the platforms and the exact address of each domain used, noting when the move from one to the next took place; and the list of personal data provided.

And a warning that always applies: anyone who contacts you promising to recover the sums on advance payment is the second scam, built on the lists of the victims of the first.

Similar cases already handled by the firm

Anyone who crossed paths with ht6953.it will find useful our analysis of the other domains of the same series: dfgr269.it, where the network of domains is reconstructed in full, mg6228.it, on the mechanism of the first successful withdrawal, dsfs36.it, on the dead domain while the network stays live, and dtw866.it, on the fake job with video likes. On blocked balances, cryptoledgerx.top is useful; on the phase after filing, with opposition to closure, see tiaozhuang12.top.

If you paid money to ht6953.it: what to do now

This is the picture. ht6953.it is a scam: a serial .it domain, active as we write, which shares its pair of name servers with six other names of the same family, and which in the same affair was flanked by two further addresses of the series.

The transfers went to a natural person with an Italian account: it is the most favourable starting point a file of this kind can have, and it is reachable within a short time.

If you have not filed yet, do not limit yourself to recounting: have the filing set out the path of the money, all the domains used, the declaration asking to be notified of any closure, and the specific requests. It is written once, and it is worth writing it well.

Our firm has already handled this case. You can submit your position to us for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.