vincita[.]vip

This domain, vincita.vip, was registered on November 19, 2025 through NiceNIC International Group Co., Limited. The authoritative nameservers ariella.ns.cloudflare.com and troy.ns.cloudflare.com resolve the domain to the Cloudflare IP address 172.67.167.143, which is associated with ASN 13335 (Cloudflare, Inc.) and geolocated to the United States. No TLS certificate was observed, indicating the site was served over plain HTTP or that the certificate was not presented at the time of analysis. The page title returned by the remote host reads “Vincita: Most Popular Online Crypto Casino Based on Blockchain”, matching the classification of a crypto‑focused gambling scam. Automated analysis identified the site as employing the publicly available “Gambler Scam” phishing kit.

VirusTotal scans recorded 12 positive detections out of 93 submitted security vendors, confirming that multiple anti‑malware engines flag the domain as malicious. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy community feed. Current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content. Evidence indicates that the infrastructure relies on Cloudflare’s reverse‑proxy network, which can obscure the true origin server and complicate takedown actions.

While the IP address is shared among many unrelated Cloudflare customers, the combination of the specific page title, the Gambler Scam kit, and the observed vendor detections provides a reliable indicator that the domain was used for a crypto‑casino phishing campaign targeting users seeking blockchain‑based gambling services. Defenders should continue to block the domain at perimeter filters and update internal threat‑intel feeds with the observed indicators, including the domain name, registration details, associated IP address, and the 12 VirusTotal detections.