vonvax[.]com

Analysis of vonvax.com, observed on July 24 2026, indicates that the domain was registered on June 26 2025 through Web Commerce Communications Limited and currently resolves to IP 69.5.189.57, which is allocated to AS42624 Global-Data System IT Corporation in Switzerland. The site was hosted without an SSL certificate and returned an offline HTTP response at the time of investigation, suggesting that the phishing infrastructure has been taken down or is otherwise inaccessible. The page title retrieved from historic snapshots reads “VONVAX | Play at the best online casino based on Blockchain”, aligning with the declared scam type of a crypto‑focused gambling fraud. The operation is linked to a known “Gambler Scam” phishing kit, a template frequently employed to lure victims into depositing cryptocurrency under the pretense of a blockchain casino.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal analysis shows that two of ninety‑five scanners flagged the domain, indicating some detection of malicious behavior despite the low overall detection rate. Reputation services assign a Gridinsoft trust score of 1 out of 100, reflecting extreme distrust. Nameserver configuration includes ns1.nameserverhub.com through ns4.nameserver, a pattern often observed in short‑lived malicious registrations.

The limited number of detections and the offline status leave uncertainty about the current operational state of the phishing campaign; however, the infrastructure footprint—especially the IP address, kit, and branding—suggests that similar domains may be deployed using the same template. Defensive recommendations include adding 69.5.189.57 and vonvax.com to deny‑list rules in firewalls and DNS filters, monitoring for newly registered domains using the same registrar or nameserver set, and employing heuristic detection for page title strings containing “casino” and “blockchain”.