vip-stake[.]io

vip-stake.io was registered through NiceNIC International Group Co., Limited on 19 December 2025. The domain resolves to 172.67.170.181, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented the page title “Vip-stake: Most Popular Online Crypto Casino Based on Blockchain” and is classified as a crypto scam that employs the Gambler Scam phishing kit, a known template used for crypto‑draining operations. SSL termination is handled by Google Trust Services under the WE1 certificate, indicating a valid HTTPS connection despite the malicious intent.

The domain is currently taken offline, but it was listed on at least one public security blocklist and is actively blocked by PhishDestroy. VirusTotal recorded 14 positive detections out of 93 scanned scanners, confirming that multiple antivirus and URL‑reputation engines recognize the domain as malicious. Nameservers are langston.ns.cloudflare.com and surina.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The combination of a recent registration date, Cloudflare hosting, a legitimate‑looking page title, and the use of a known gambling‑oriented phishing kit suggests a deliberate attempt to lure cryptocurrency users into depositing funds that are subsequently siphoned.

Defenders should immediately add vip‑stake.io to URL filtering and DNS blocklists, monitor traffic to the underlying IP address for any residual activity, and consider extending blocks to the associated Cloudflare nameservers if similar patterns emerge. Continuous observation of the domain’s registration and any re‑appearance on the internet is advised, as threat actors often reactivate taken‑down sites with minor modifications. Correlation with other Gambler Scam kit deployments may help identify broader campaign infrastructure.