vavadabb[.]casino

This domain vavadabb.casino is currently active and hosts a fraudulent crypto‑gambling front‑end that leverages the publicly known Gambler Scam phishing kit. DNS resolution points to IP 194.26.232.73, an address located in the Netherlands and announced by ASN 211381 (Podaon SIA). The web server is Nginx and the site presents a valid Let’s Encrypt certificate (R13) with an HTTP 301 redirect. Both authoritative nameservers are Cloudflare (erin.ns.cloudflare.com, hans.ns.cloudflare.com). Independent analysis shows eight of ninety‑five VirusTotal scanners flag the domain, Gridinsoft assigns a trust score of 0 / 100, and it is listed on one external blocklist. PhishDestroy has already blocked the host and AlienVault OTX cites it in a single threat pulse. The page title advertises a “VAVADA Online Casino” in Russian, confirming the crypto gambling theme. No publicly available content has been examined, so the exact credential‑capture mechanisms remain unknown. Defenders should ingest the IP and domain into DNS and proxy blocklists, enforce TLS inspection to capture any malicious payloads, and monitor for outbound connections to the resolved IP. Correlating internal logs for traffic to 194.26.232.73 or HTTP 301 responses to vavadabb.casino will help identify compromised users. Updating threat‑intel feeds with the provided indicators will reduce exposure to this high‑risk infrastructure.