zenvado[.]bet

zenvado.bet has been assessed by PhishDestroy as an active credential-harvesting domain posing an elevated risk to end users. The infrastructure and historical behavior indicate a campaign designed to trick visitors into surrendering login credentials under false pretenses.

PhishDestroy’s analysis of zenvado.bet confirms the following technical indicators: only one of ninety-five VirusTotal security vendors flagged the domain, reflecting low public detection coverage; the domain resolves to IPv4 address 188.114.97.3; it was created on March 01, 2026; the SSL certificate is issued by Let’s Encrypt; and the registration was handled through PDR Ltd. d/b/a PublicDomainRegistry.com. Despite the youth of the domain, its rapid deployment to a known hosting range and issuance of a publicly trusted certificate suggest deliberate attempts to gain user trust while evading early-stage detection mechanisms.

To neutralize the threat, organizations should immediately block zenvado.bet at DNS and network layers and prevent SSL decryption bypass for 188.114.97.3. Users who may have entered credentials should rotate those passwords immediately and enable multi-factor authentication where supported. Security teams are advised to inspect proxy logs for recent connections to the domain or IP and to consider a retroactive hunt for additional newly registered domains exhibiting similar patterns.