vandamining[.]net

The domain vandamining.net is currently active and has been identified as a high‑risk generic phishing infrastructure. It was registered on April 28, 2026 through Aquarius Domains, LLC and resolves to the IP address 103.224.212.216, which is geolocated to Australia and associated with Trellian Pty. Limited. The authoritative nameservers are ns15.abovedomains.com and ns16.abovedomains.com, and the domain uses a Let's Encrypt R13 certificate, returning HTTP 200 for the root page. Email services are directed to park-mx.above.com (priority 10). Threat intelligence indicates that 12 of 91 security vendors on VirusTotal have flagged the domain, and it appears on a single security blocklist, where it is actively blocked by PhishDestroy. An AlienVault OTX pulse references the domain, and Gridinsoft assigns a trust score of 1 out of 100. While the page title is simply "vandamining.net" and no further content analysis is available, the combination of recent creation, active hosting, multiple vendor detections, and blocklist presence suggests a deliberate phishing operation. Defenders should add the domain and its resolved IP to deny‑list rules, monitor for any related C2 activity, and consider tightening email filtering for the associated MX host. Continuous observation is advised to capture any evolution of the infrastructure.