raylsvaults[.]xyz

This domain, raylsvaults.xyz, poses an elevated generic phishing threat. Analysis indicates that it has been used to host phishing pages designed to steal sensitive information such as login credentials and financial data from unsuspecting users. The domain has been taken offline, but it remains a significant risk due to its previous malicious activities and the potential for reactivation or reuse by threat actors.

Evidence from various sources confirms the malicious nature of raylsvaults.xyz. On VirusTotal, 6 out of 95 security vendors have flagged this domain as potentially harmful. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 28, 2026, and has appeared on 3 security blocklists. The infrastructure utilizes Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which can obscure the true nature of the domain. Additionally, the SSL certificate is issued by Let's Encrypt, a common choice for phishing sites to appear more legitimate. The domain resolves to the IP address 172.67.214.154.

Users who have visited raylsvaults.xyz are advised to immediately check their accounts for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication (2FA) on all affected accounts. Users should also monitor their financial statements and credit reports for any signs of fraud. If any personal or financial information was entered on the site, it is crucial to report the incident to the relevant service providers and to a cybersecurity professional for further assistance.