edelvaults[.]xyz

edelvaults.xyz was registered on May 23 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. in Canada. DNS is served by arushi.ns.cloudflare.com and jonah.ns.cloudflare.com. The site presents a valid HTTPS certificate from Let’s Encrypt (E7), and HTTP requests return status 200, indicating an active web service. Infrastructure analysis shows a Gridinsoft trust score of 0 / 100, placing the domain in the lowest trust tier. It appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in a single threat pulse, and VirusTotal records four detections out of ninety‑five scanners, confirming that multiple security engines have identified malicious behavior. The current intelligence classifies the activity as generic phishing, but the specific brand or service being spoofed has not been observed in the available data. Content analysis of the landing page has not been published, leaving the exact credential‑harvesting technique and targeted user base uncertain. No additional hosting details beyond the Cloudflare front‑end are disclosed. Defenders should add 188.114.96.3 and edelvaults.xyz to network‑level deny lists and enforce DNS filtering for the domain. Continuous monitoring of Cloudflare‑hosted IPs associated with this domain is advised, as the attacker may shift to alternate IPs under the same provider. Organizations should educate users about unsolicited login prompts and verify URLs before credential entry, especially for services potentially mimicked by this site.