daddycvl003[.]site

This domain, daddycvl003.site, is flagged as a generic phishing infrastructure impersonating the Daddy Casino brand. Analysis of the page title—"Daddy Casino — Играй только в лучшие игры! Рекордные выигрыши вместе с нами!"—indicates a targeted campaign against Russian-speaking users, likely designed to harvest login credentials or financial details through fake online gaming promotions. No specific drainer kit signatures were identified in available telemetry, though the use of localized content suggests a tailored phishing operation rather than a broad-scale attack. Infrastructure analysis reveals the following technical indicators: the domain was registered on September 26, 2025, through Atak Domain and resolves to the IP address 85.121.149.195. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while Gridinsoft and Scamadviser both assign a trust score of 1/100. The domain appears on one security blocklist and was referenced in a single AlienVault OTX threat intelligence pulse. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, though the domain was actively blocked by at least one security provider. As of the latest assessment, daddycvl003.site has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat due to its recent registration and association with a known phishing registrar. Users who interacted with the domain should assume credential compromise and rotate passwords for any accounts accessed during the exposure window. Organizations are advised to monitor for related domains registered through Atak Domain or resolving to 85.121.149.195, as the operators may redeploy similar infrastructure under new names.