vantheon-lux[.]org

Analysis indicates that the domain vantheon-lux.org was registered on March 06, 2026 through NameCheap, Inc. The site is currently offline, and its DNS resolves to 172.67.193.159, an address owned by AS13335 Cloudflare, Inc. in the United States. The domain is served by Cloudflare nameservers vivienne.ns.cloudflare.com and wesley.ns.cloudflare.com, and no TLS certificate was observed, meaning HTTPS connections are not secured. The page title retrieved from the site, "Vantheon Lux — Official Cryptocurrency Platform with Secure AI Autopilot and Verified Trust," advertises a cryptocurrency service but provides no further technical detail.

The domain appears on three public security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that two of ninety‑four security vendors flagged the domain, reinforcing the suspicion of malicious intent. The combination of recent registration, lack of SSL, reliance on Cloudflare infrastructure, and presence on multiple blocklists suggests a purpose-built phishing infrastructure targeting cryptocurrency users.

However, the offline status limits current visibility into the exact payload or credential‑capture mechanisms employed. Defenders should continue to block the domain at network perimeter, update URL filtering rules, monitor for any future resolution changes, and consider adding the domain to internal threat intelligence feeds. Ongoing observation of the associated IP address for anomalous traffic may also be warranted, especially if the address begins serving active content.