vavada963[.]com

Analysis of vavada963.com shows a high‑risk, active phishing infrastructure targeting cryptocurrency gambling users. The domain was registered on October 24, 2025 through NameCheap, Inc. and is hosted on Cloudflare nameservers (etienne.ns.cloudflare.com, zelda.ns.cloudflare.com). DNS resolution points to IP 194.26.232.73, an address located in the Netherlands and assigned to AS211381 (Podaon SIA). The web server runs Nginx and presents a TLS certificate from Let’s Encrypt (R13). An HTTP 301 redirect is observed, and the page title returned is “VAVADA Online Casino,” indicating a crypto gambling lure. The site is associated with the publicly known Gambler Scam kit and is classified as a crypto‑gambling phishing campaign. Threat intelligence sources corroborate the activity: VirusTotal reports 12 of 95 scanners flagging the domain, it appears on one security blocklist, is blocked by PhishDestroy, and is referenced in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 0 / 100. While the exact phishing payload has not been captured, the convergence of registrar data, hosting details, kit attribution, and multiple detections confirms a malicious intent. Defenders should block the domain and its resolving IP at network perimeter, monitor for DNS queries to the listed Cloudflare nameservers, and enforce TLS inspection to detect the redirect behavior. Continuous re‑evaluation is advised as additional indicators may emerge.