podavex[.]com

Analysis indicates that podavex.com was registered on March 06, 2026 through NiceNIC International Group Co., Limited and subsequently pointed to Cloudflare's edge network (AS13335, United States) at IP address 104.21.8.153. The authoritative nameservers harvey.ns.cloudflare.com and rosemary.ns.cloudflare.com resolve the domain to the same Cloudflare edge, consistent with a fast‑flux or CDN‑based hosting model often used to hide malicious infrastructure. The site’s HTML title reads “Podavex: Most Popular Online Crypto Casino Based on Blockchain”, aligning with the classified scam type “Crypto Scam” and the observed deployment of a “Gambler Scam” phishing kit. No TLS certificate was observed, indicating the site served HTTP only, which further reduces trust signals for potential victims.

Detection data show that three of ninety‑four VirusTotal scanners flagged the domain, and the domain appears on a single external blocklist. PhishDestroy has already taken the site offline, and the current status is reported as offline. The limited detection footprint suggests that the campaign was short‑lived or targeted, but the presence of a known gambling‑focused phishing kit implies a systematic attempt to harvest cryptocurrency credentials. Uncertainties remain regarding the exact victim profile, the extent of credential harvesting, and whether additional infrastructure (e.g., command‑and‑control servers) was employed beyond the Cloudflare edge.

No SSL certificate, no redirect chains, and no further public intelligence sources were available at the time of analysis. Defenders should block resolutions to 104.21.8.153, add podavex.com to URL filtering lists, and monitor for similar domains registered through NiceNIC that resolve to Cloudflare edges with no TLS. Threat‑intel feeds should note the association with the Gambler Scam kit and the “Crypto Scam” label to improve detection of future campaigns that reuse this infrastructure pattern.