vgamblpay[.]com

This domain vgamblpay.com is currently active and serves a phishing campaign targeting users of crypto gambling platforms. The site presents the page title “Games – VAVADA Online Casino”, indicating an attempt to impersonate the VAVADA brand. Infrastructure analysis shows the domain was registered on 16 January 2025 through REGRU‑RU and resolves to IP 176.97.79.105, which belongs to AS58061 Scalaxy B.V. in the Netherlands. The authoritative nameserver entries point to ns1.vgamblpay.com (5.61.53.145) and ns2.vgamblpay.com, confirming the domain’s own DNS infrastructure. The web server is Nginx and presents an HTTP 500 response under TLS 1.2 with a Let’s Encrypt certificate. Threat intelligence sources list the domain in 23 AlienVault OTX pulses and associate it with the “Gambler Scam” phishing kit, classified as a crypto gambling scam. It is already blocked by PhishDestroy and appears on one public blocklist. Although VirusTotal flagged the domain by two security vendors, the limited detection suggests that additional analysis may be required. Uncertainties remain regarding the exact content delivered to victims, as the site currently returns an error code and no page content has been captured. Defenders should block the domain and its associated IP at perimeter controls, monitor DNS queries for the listed nameservers, and consider sinkholing the address range. Continuous observation of threat feeds for new indicators related to this infrastructure is advised.