# falconvaultwick.ink — SUSPICIOUS

> PhishDestroy identifies falconvaultwick.ink hosting a Discord login phishing scam. VirusTotal 0/95 detections, flagged by Google Safe Browsing.

## Summary
PhishDestroy identifies a Discord login phishing domain operating at falconvaultwick.ink. This site mimics a legitimate Vault Discord service login portal to harvest credentials from unsuspecting users. The domain was registered on March 22, 2026, via Dynadot Inc and currently resolves to IP address 188.114.97.3. It utilizes a Let’s Encrypt SSL certificate to appear trustworthy, while Google’s Safe Browsing service has already flagged it under social engineering indicators. Despite zero detections on VirusTotal as of the latest check, the absence of widespread blocking does not reduce the immediate threat posed by this active impersonation campaign.


This threat is classified as a credential harvesting attack targeting Discord users who may confuse falconvaultwick.ink for the official Vault service. The domain employs a deceptive naming strategy using ‘vault’ to imply association with Discord’s Vault feature, a tool used for storing media. Technical indicators include recent registration date, low AV coverage, and a social engineering flag from a major browser safety service. Risk remains high due to active operation and potential for further evasion tactics such as fast-flux DNS or dynamic IP changes. Users interacting with this domain risk exposing their Discord account credentials, leading to potential account takeover, data theft, or involvement in wider phishing campaigns.


If you visited falconvaultwick.ink or entered any credentials, immediately change your Discord password and enable two-factor authentication. Review account activity for unauthorized logins and revoke any suspicious third-party app permissions. Use a password manager to avoid entering credentials on untrusted sites. Report the domain to Discord via their fraud reporting channels and consider running a malware scan. Stay alert: avoid clicking links in unsolicited messages and verify domains by checking official Discord URLs or using a trusted bookmark. Always check unknown domains using PhishDestroy’s tools before entering sensitive information.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-22 21:05:07
- Registrar: Dynadot Inc
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: FLAGGED
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/44661357-4ed5-4116-b690-88dfe2377aad
- PhishDestroy: https://phishdestroy.io/domain/falconvaultwick.ink/
- LLM endpoint: https://phishdestroy.io/domain/falconvaultwick.ink/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/falconvaultwick.ink/
Last updated: 2026-03-23