vordbet[.]com

vordbet.com was registered on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc and uses the nameservers ns100.webnic.cc and ns101.webnic.cc. The domain resolves to the IPv4 address 57.129.97.29, which belongs to AS16276 (OVH SAS) and is geolocated in Germany. An SSL certificate identified as “E6” is present for the domain, indicating transport encryption was configured. The site presented the page title “VORDBET | Enter the world of sport and stakes!” and is classified as a brand‑impersonation campaign targeting the brand “blast”. VirusTotal analysis recorded a single positive detection out of 93 scanning engines.

The domain is listed on one public blocklist and has been actively blocked by the PhishDestroy mitigation service. As of the report date, the domain is taken offline, but the infrastructure remains observable. Analysis confirms that the registration, hosting, and naming service details are consistent with a short‑lived malicious operation. The limited detection footprint—only one vendor flag and a single blocklist entry—suggests that the campaign may have been in an early stage or that detection coverage is incomplete. The presence of an SSL certificate and a plausible sports‑betting themed title are typical of brand‑impersonation attempts designed to lure users into believing the site is legitimate.

No additional payload, redirect behavior, or credential‑harvesting mechanisms have been publicly disclosed, leaving the exact malicious functionality uncertain. Defenders should add 57.129.97.29 to network‑level deny lists, enforce DNS filtering for vordbet.com, and monitor for any resurgence of the domain or related subdomains. Continuous re‑scanning on multi‑engine platforms is advised to capture any future changes in detection status. Organizations that reference the “blast” brand should educate users about the fraudulent use of the VORDBET title and advise against interacting with any site hosted on the identified IP address.