evespin[.]com

Analysis on evespin.com indicates that the domain was created on 23 May 2025 through Web Commerce Communications Limited and is currently hosted on the IP address 176.97.79.105, which belongs to AS58061 Scalaxy B.V. in the Netherlands. The authoritative name servers are fish.ns.cloudflare.com and hasslo.ns.cloudflare.com, confirming the use of Cloudflare DNS infrastructure. No TLS certificate is presented for the site, and the HTTP service has been taken offline at the time of this assessment. The page title returned before takedown was “Games – VAVADA Online”, matching the classified scam type of crypto gambling.

The domain is listed on a single security blocklist and is actively blocked by PhishDestroy, reflecting its identification as a brand‑impersonation campaign targeting the Camelot brand. VirusTotal records show that one out of ninety‑five scanning engines flagged the domain, providing additional corroboration of malicious intent. The observable evidence confirms that evespin.com was leveraged to masquerade as a legitimate Camelot gambling service, likely to lure victims into crypto‑based betting schemes. Because the site is already offline, immediate mitigation focuses on preventing residual traffic.

Defenders should add the domain and its resolving IP to network‑level blocklists, enforce DNS filtering for the Cloudflare name servers, and monitor for any re‑registration attempts or similar domains using the same registrar. Continued observation of the AS58061 address space is advised, as the hosting provider may be reused for future campaigns. At present, no SSL certificate or additional content has been captured, leaving the exact phishing page layout unknown. Further forensic capture of HTTP responses, if the site reappears, would be required to enrich attribution.