xn--r-7sbo6bq[.]xn--flrvult-5fg5bc1hwa8d4mc4535ihag[.]vault-s1[.]eu[.]com

The domain xn--r-7sbo6bq.xn--flrvult-5fg5bc1hwa8d4mc4535ihag.vault-s1.eu.com was registered on February 21, 2026 through Instra Corporation Pty Ltd. The site is currently offline but historical observations indicate an elevated‑risk brand impersonation campaign targeting the brand "across". The page title returned from the live host was "Nibble Yearn Finance - Restaurant Inspired by DeFi Magic", which aligns with the listed scam type of a crypto scam. Technical infrastructure analysis shows the domain resolves to the IP address 172.67.214.225, an address owned by Cloudflare, Inc. (AS13335) and located in the United States.

Four CentralNic name servers (ns1.centralnic.net through ns4.centralnic.net) are authoritative for the zone, and the MX record points to eu-com-wildcard-null-mx.centralnic.net with priority zero, indicating a null‑mail configuration commonly used in fraudulent domains. The SSL certificate is identified as grade E5, suggesting a low‑trust certificate. Reputation data reveal that three of ninety‑three VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Given the combination of a brand‑impersonation page title, low trust scores, and partial detection by multiple security vendors, defenders should continue to block the domain and its associated IP address at perimeter defenses, monitor for any resurgence of the host, and apply similar detection logic to other domains that resolve to the same Cloudflare IP range or share the CentralNic name server set. Ongoing intelligence collection is advised to confirm whether the offline status persists and to detect any re‑registration attempts that may reuse the same registrar or naming patterns.