trustvault[.]art

The domain trustvault.art was registered on February 21, 2026 through the registrar Gname.com Pte. Ltd. and resolves to the IP address 104.21.43.12, which belongs to AS13335 Cloudflare, Inc. in the United States. The site was protected by Cloudflare services, employing HTTP/3, and presented the page title "Suspected phishing site | Cloudflare" when accessed. An HTTP 403 response was observed, indicating that the server denied the request. The SSL certificate presented was issued by Google Trust Services under the designation WE1, confirming the use of a valid TLS certificate.

Threat intelligence records show that the domain appears on three security blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis returned 11 detections out of 93 scanners, and AlienVault OTX listed the domain in a single threat‑intel pulse. The domain is currently marked as offline, and no further content has been captured beyond the generic Cloudflare title.

While the evidence confirms that trustvault.art has been used for an investment‑type phishing campaign, the exact payload, targeted brands, or victim interaction flow remain unknown. Security operators should continue to deny traffic to the domain, add the associated IP and nameservers (dalary.ns.cloudflare.com, jerry.ns.cloudflare.com) to blocklists, and monitor for any re‑use of the same registration or hosting patterns. Ongoing observation of future DNS changes or re‑activation attempts is recommended to ensure rapid mitigation if the site resurfaces.