vavadagso[.]site

Analysis of the domain vavadagso.site indicates a confirmed brand impersonation campaign targeting the Camelot brand, classified as elevated risk. The domain was registered on October 8, 2025, through the registrar Atak Domain, with nameservers eugene.ns.cloudflare.com and faye.ns.cloudflare.com, suggesting Cloudflare infrastructure. It resolves to the IP address 172.67.211.71, hosted under AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate was detected at the time of assessment, increasing the likelihood of unencrypted malicious activity. The page title, 'Games - VAVADA Online,' does not directly reference Camelot but aligns with the reported scam type of brand impersonation.

Security vendor detections are limited but notable: the domain appears on one security blocklist and is flagged by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. VirusTotal reports four detections out of 95 security vendors, while AlienVault OTX includes the domain in one threat intelligence pulse, indicating prior identification in active campaigns. The domain was taken offline by the time of this report, though defenders should treat its infrastructure as potentially reusable for future threats.

Defenders are advised to block the domain at perimeter security controls and monitor for reuse of the IP (172.67.211.71) or registrar (Atak Domain) in new phishing campaigns. Given the Cloudflare hosting, additional scrutiny of domains leveraging similar nameserver configurations may be warranted. No evidence of a phishing kit or specific payload delivery mechanism is available, so further forensic analysis of archived samples may be required to determine attack vectors. The absence of an SSL certificate and low detection counts do not diminish the risk, as brand impersonation domains often evade initial scans before widespread distribution.