vavodex[.]com

The domain vavodex.com was registered on August 12, 2025 through Key-Systems GmbH and resolves to the IPv4 address 176.97.79.105, which is assigned to AS58061 Scalaxy B.V. in the Netherlands. Authoritative nameservers fish.ns.cloudflare.com and hasslo.ns.cloudflare.com indicate that Cloudflare’s DNS infrastructure is being used. No TLS certificate is presented, so any communication with the site would have been unencrypted. A static page title retrieved before the site was taken offline reads “Games – VAVADA Online,” implying the site was crafted to imitate the VAVADA gambling platform, consistent with the classified social‑media phishing campaign.

VirusTotal recorded a single positive detection out of 95 scanned engines, demonstrating that at least one security vendor flagged the domain as malicious while the majority did not, suggesting limited but non‑trivial malicious labeling. The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist, providing concrete indicators that can be leveraged for network‑level filtering. Because the site is currently offline, real‑time content inspection is not possible, and the exact phishing payload, credential‑capture form, or redirect behavior remain unknown. Defenders should proactively block both the IP address 176.97.79.105 and the domain vavodex.com at DNS resolvers, firewalls, and proxy filters.

Adding the domain to internal URL filtering lists and to external blocklists such as PhishDestroy will reduce exposure. Continuous monitoring of the registrar Key-Systems GmbH and the Cloudflare nameservers for new sub‑domains or re‑registration attempts is advisable, as the same infrastructure may be reused in future campaigns. Correlating outbound traffic to the listed IP with user‑agent strings or referral patterns typical of social‑media phishing can help identify compromised endpoints.