vavada[.]buzz

Analysis of vavada.buzz, observed on July 24 2026, shows a domain created on 24 August 2025 and registered through Web Commerce Communications Limited. The domain resolves to 176.97.79.105, an address announced in the Netherlands under ASN 58061 (Scalaxy B.V.). Nameservers fish.ns.cloudflare.com and hasslo.ns.cloudflare.com indicate Cloudflare DNS services. No TLS certificate is presented, meaning the site served only HTTP connections. The page title returned from the live endpoint before takedown was “Games - VAVADA Online”, which does not directly reference the targeted brand.

However, intelligence flags the domain as a brand‑impersonation campaign targeting the Camelot brand, and the site has been listed by PhishDestroy as a malicious impersonator. VirusTotal scans recorded two positive detections out of ninety‑five vendors, confirming that at least a minority of security products consider the domain malicious. The domain appears on a single public blocklist, and its current operational status is reported as offline, suggesting the site has been taken down or otherwise rendered inaccessible. Uncertainty remains regarding the exact content and user‑experience that was delivered before the takedown, as no screenshot or HTML capture is available.

The lack of an SSL certificate also limits the ability to inspect encrypted traffic, but the absence of HTTPS further reduces the attack surface for credential harvesting. Defenders should continue to block the IP address 176.97.79.105 and the domain vavada.buzz at perimeter filters, add the domain to internal phishing‑watch lists, and monitor for any future re‑registration or use of similar naming patterns. Because the domain leverages Cloudflare DNS, additional scrutiny of associated sub‑domains may be warranted. Ongoing vigilance with reputation services and periodic re‑scanning of the domain are recommended to capture any re‑emergence of malicious activity.