vaxobet[.]com

On 25 July 2026 analysts observed that the domain vaxobet.com was taken offline after being identified as a fraudulent site that masquerades as the charitable organization “foundation”. The domain was registered on 20 July 2025 through MAT BAO CORPORATION and uses four nameservers (ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, ns4.nameserver). DNS resolution points to IP address 69.5.189.58, which is assigned to AS42624 Global‑Data System IT Corporation and geolocated to Switzerland. No TLS certificate was presented, indicating that the site operated without HTTPS. The page title retrieved during the brief online window read “VAXOBET | Play at the best online casino based on Blockchain”, suggesting a gambling‑oriented landing page that employed the Gambler Scam kit.

VirusTotal scans returned nine positive detections out of ninety‑three vendors, and the domain appears on a single security blocklist. PhishDestroy has confirmed the domain as blocked, and AlienVault OTX listed it in one threat‑intel pulse. Independent reputation scoring from Gridinsoft assigned a trust score of 1 out of 100, reinforcing the malicious assessment. The combination of a low trust score, multiple vendor detections, and association with a known gambling scam kit indicates a high likelihood that the site was used to solicit cryptocurrency or other payments under the guise of the “foundation” brand.

At present the exact payload or victim interaction flow has not been captured, and no SSL/TLS fingerprint or detailed HTTP response codes are available. Defenders should continue to block the IP address 69.5.189.58 and the domain vaxobet.com at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the domain to internal threat‑intel feeds. Analysts should also watch for other domains using the same nameserver set or hosting provider, as they may share the underlying infrastructure.