vavadawins1[.]com

The domain vavadawins1.com was registered on 27 June 2025 through Web Commerce Communications Limited and is currently offline as of the 24 July 2026 reporting date. DNS resolution points to the IPv4 address 176.97.79.105, which is allocated to AS58061 (Scalaxy B.V.) and geolocated to the Netherlands. The authoritative nameservers are fish.ns.cloudflare.com and hasslo.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate was observed for the domain, meaning HTTPS connections are not available and any traffic would be transmitted over HTTP only.

The site’s page title, as captured before takedown, reads "Games - VAVADA Online," which does not directly reference the targeted brand but the intelligence profile identifies the campaign as a brand impersonation targeting the Camelot brand. VirusTotal analysis recorded a single positive detection out of ninety‑five scanned security vendors, and the domain appears on one external blocklist. PhishDestroy has also listed the domain as blocked, providing an additional layer of defensive tagging. The limited detection footprint suggests the campaign was short‑lived or narrowly distributed, yet the presence on a blocklist and a vendor flag demonstrates that at least one security product recognized malicious intent.

Defenders should continue to monitor for any residual infrastructure reuse, particularly the IP address 176.97.79.105 and the associated Cloudflare nameservers, as threat actors frequently recycle hosting resources. Blocking the domain, its IP, and associated nameservers at the network perimeter is recommended. Additionally, threat‑intel feeds should be updated to retain the observed indicators of compromise, and any future queries for the Camelot brand should be cross‑referenced against this indicator set to detect potential re‑use of the impersonation technique.