We have already handled a zs8596.it scam case, the twin platform the client was moved to after the first one. Different network addresses, but the same pair of nameservers: one account, one hand. If you were caught by the same scam we can help you: use the form at the bottom of this page.
Note: we are a law firm dealing exclusively with online fraud. If you were caught in the same trap and want help, you can write to us using the form at the bottom of this article.
Why we say zs8596.it is a scam
We have already handled the case of a professional who lost around ten thousand euros across two twin platforms. The first was fgre369.it, which we covered in a dedicated article. The second is zs8596.it, and that is the one we discuss here.
The reason we give it a separate article is simple: in our experience the second site is the step victims describe worst and investigators value most. Understanding what happens when someone is "moved" to a new platform is the quickest way to recognise the fraud while it is still running.
The second site is not a fallback: it is the second half of the script
Nobody arrives at zs8596.it by chance. You arrive because someone sends you there, and the reason given almost always comes from a fixed repertoire: the first site is "under maintenance", the platform has been "upgraded", the account has been "migrated to a more secure system", the previous login "is no longer compatible".
None of this happens at a real operator. An intermediary that changes infrastructure does not ask its clients to start again from scratch on a different domain with a different name: it keeps its own name, because the name is its asset.
Those running these collections do the opposite, for two very concrete reasons. The first is defensive: after a few months the first domain starts appearing in reports, forums and lists of suspicious sites, and a single online search is enough to scare off new contacts. The second is offensive: moving the victim to a new site resets the doubts that have accumulated, restarts the relationship and, above all, breaks up in her mind the perception of a single course of events.
That last point is the most insidious. In the zs8596.it case, as in many others, the people who come to us say "I lost five thousand euros on one site and then another five thousand on a different one", and they tell it as if these were two separate misfortunes. They are not.
Different addresses, the same control panel
In the public registers we checked two things about zs8596.it which, taken together, explain why the "separation" between the two sites is only apparent.
The first: zs8596.it and its twin do not answer from the same network addresses. They are different numbers, belonging to different blocks. If you stopped there you would conclude that these are two distinct infrastructures.
The second: both domains delegate name management to the very same pair of nameservers. And that pair is not a generic datum: it is assigned per individual account of the service used. It is not a resemblance, it is an identity.
The result is instructive in general terms too, and it is why we insist on this point in every check we run: network addresses prove nothing, because behind a single address of a content delivery network millions of unrelated sites coexist, and different addresses do not mean different operators. Nameservers, on the other hand, do speak. Whoever administers zs8596.it also administers the other domain, from the same panel.
Why this changes the complaint
Bringing this element into a criminal complaint is not a technical exercise: it changes the structure of the case.
If the two platforms are treated as separate matters, you have two episodes of modest size, each with its own loss, each potentially destined for a different file. If instead you show that they are attributable to the same management, you have a single criminal design, to be charged as a continuing offence under article 81, second paragraph, of the Italian Criminal Code, with an overall loss that also weighs differently for the aggravating circumstance under article 61 no. 7.
There is then an evidential aspect concerning the moment of the move itself. The date on which you were told to switch to zs8596.it, and the reason you were given, are elements to record precisely in the complaint: that is the point at which the organisation had to take a decision, and it often coincides with events verifiable in the registers or with the appearance of the first public reports about the previous domain.
This too is an .it domain
What we wrote about its twin applies to zs8596.it as well, and it deserves repeating because almost nobody knows it.
.it domains are not assigned anonymously. The Italian Registry, run by a public research body, requires a registrant belonging to the European Union or to the other admitted countries, acceptance of the assignment rules, and identifying data which are retained. A public query does not show them, but they exist, they are in Italy and they can be obtained by the judicial authority.
With two twin domains this produces a further effect: the two registrant records can be compared. If they match, the link is proved directly. If they do not match, despite the common technical management we established, that discrepancy does not weaken the picture: it strengthens it, because it points to the use of front registrants.
A domain with no mail
Neither zs8596.it nor the twin domain has a mail server configured: no email can be received at those addresses.
It is a detail always worth checking, because it takes seconds and says a great deal. An entity claiming to manage other people's money that cannot receive a written complaint, a request for clarification or a formal notice is not an operator: it is a temporary shop window, destined to be switched off.
Beware of the third contact
After zs8596.it and the twin domain a third voice often arrives. In the case we followed, our client was called at eleven at night from a foreign number by someone introducing himself using our firm's name. It was not us.
We flag it because it is the natural completion of this scheme: whoever has lost money looks for help online, and whoever sold or passed on their data knows it. Our firm does not telephone late at night, does not call from foreign numbers, never asks for payments to personal accounts, prepaid cards or in cryptocurrency, and never asks for passwords or one-time codes. If you receive a call of this kind, end it and contact us again through the details published on this site. Using someone else's name to obtain money amounts to impersonation under article 494 of the Italian Criminal Code.
The criminal framework
The conduct of whoever ran zs8596.it amounts to fraud under article 640 of the Italian Criminal Code, aggravated under the second paragraph no. 2-bis for exploiting the circumstance of distance referred to in article 61 no. 5, and by the paragraph 2-ter aggravating circumstance introduced by law 90/2024 for frauds committed with IT tools apt to hinder identification of the perpetrator.
To this are added, depending on the features of the collection, the unlawful provision of investment services under article 166 of the Consolidated Law on Finance, punished by one to eight years' imprisonment, and money laundering under article 648-bis or self-laundering under article 648-ter.1 as regards whoever received and moved the sums.
As to tools: banking records can be obtained for ten years under article 119, fourth paragraph, of the Consolidated Banking Law; intermediaries keep identification data for the same period under legislative decree 231/2007; the domain registrant's data can be obtained from the Registry; for anything abroad the tools are the European Investigation Order under legislative decree 108/2017 and preventive seizure under article 321 of the Code of Criminal Procedure. Aggravated fraud becomes time-barred after six years, up to seven years and six months with interrupting acts.
What to do if you were moved to a second site
If you were directed to zs8596.it, write out the chronology first: when you were contacted, when you were asked to switch and with what justification, on what dates and for what amounts you paid into each platform. Keep the screenshots of both sites, because the first may already be switched off. Ask your bank for complete payment records showing the beneficiaries' IBANs. State expressly in the complaint that the two domains appear to be run from the same account, because that is a verifiable circumstance. Do not pay any more money, under any heading. And be wary of anyone contacting you promising immediate recovery of your funds.
We can help you
Our firm deals exclusively with online fraud and has already handled cases entirely comparable to zs8596.it: Italian domains with random names, platforms that pass the victim between them, and second groups impersonating those who should be helping her.
If you have paid money to zs8596.it or to a platform working the same way, contact us using the form at the bottom of this page: we will review the documents and tell you honestly what concrete prospects exist in your case.
You can read other comparable cases we have handled:
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
