vegamb[.]cc

PhishDestroy identifies vegamb.cc as an active generic phishing domain impersonating gambling platforms to harvest user credentials. The domain was registered on March 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 104.21.20.188. With a Let's Encrypt SSL certificate, this domain may appear legitimate at first glance, but it is flagged by 5 out of 95 VirusTotal security vendors, indicating elevated risk. The phishing kit deployed here is likely designed to mimic popular gambling login pages, tricking users into submitting their credentials or payment details directly to attackers. This domain exhibits several red flags for phishing activity. It was created just days ago (March 17, 2026), a common tactic used by threat actors to quickly deploy and discard malicious infrastructure. The domain resolves to IP 104.21.20.188, a hosting provider often associated with malicious activity. VirusTotal shows a detection rate of 5/95 security vendors, which, while not overwhelming, is sufficient to warrant caution. The registrar, NICENIC INTERNATIONAL GROUP CO., LIMITED, has been linked to numerous phishing and scam domains in the past. At the time of analysis, this domain remains active and unblocked by Google Safe Browsing (GSB) and other major blocklists, making it a persistent threat to unsuspecting users. As of this report, vegamb.cc is actively hosting a credential-stealing phishing page. Security researchers and users are advised to block this domain immediately using local DNS or firewall rules. Given the domain’s recent creation and low but present detection rate, the risk of encountering this threat remains elevated. Users should avoid interacting with this domain and report it to their security teams or through platforms like PhishDestroy to prevent further spread. The only effective mitigation is proactive blocking and user awareness to recognize and avoid such fraudulent sites.