vanityaddress[.]xyz

The domain vanityaddress.xyz was registered on February 21, 2026 through NameSilo, LLC and resolves to the IP address 188.114.96.3, which belongs to Cloudflare’s AS13335 network located in the United States. The site lacks an SSL certificate, meaning traffic is not protected by HTTPS. A page title retrieved from the live host before it was taken offline reads "波场Tron靓号地址生成器 & TRC20钱包靓号地址 & 波场在线钱包 - 波场靓号," indicating the page was positioned as a Tron‑related address generator and wallet service. VirusTotal scans show that five of ninety‑three security vendors flagged the domain, suggesting malicious characteristics were observed by a minority of scanners.

The domain appears on a single public blocklist, PhishDestroy, confirming that at least one anti‑phishing service has identified it as a threat. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, reinforcing the suspicion of abuse. The domain’s nameservers are hattie.ns.cloudflare.com and joel.ns.cloudflare.com, both Cloudflare‑managed, a common choice for fast‑deployment phishing infrastructure. Current status is offline, so active probing is not possible, and no HTTPS handshake can be observed.

What remains uncertain is the exact payload or credential‑harvesting mechanism employed, as no page content beyond the title has been captured. Defenders should continue to block vanityaddress.xyz at perimeter devices, update DNS filtering feeds with the observed IP and domain, and monitor for any re‑hosting attempts that might use the same Cloudflare‑owned IP range. Continuous observation of VirusTotal and blocklist updates is recommended to capture any new detections, and any traffic logs showing connections to 188.114.96.3 should be investigated for potential credential theft related to Tron or TRC20 wallet services.