schildvaultaris[.]biz

On 24 July 2026 investigators examined the domain schildvaultaris.biz, which was created on 6 March 2026 through Dynadot LLC. The site resolves to the Cloudflare edge address 188.114.97.3, belonging to ASN 13335 (Cloudflare, Inc.) and is geolocated to the United States. DNS queries return the Cloudflare authoritative name servers felipe.ns.cloudflare.com and jule.ns.cloudflare.com. The HTTPS service presents a Let’s Encrypt certificate issued by the E7 intermediate, indicating a standard automated certificate rather than a brand‑specific TLS deployment. VirusTotal records show that one out of ninety‑four scanning vendors flagged the domain, confirming at least a minimal detection signal. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as malicious.

The only publicly visible page title reads 'Schild Vaultaris 2026: Capitalize on Bitcoin ETF Opportunities', and the threat profile lists 'Brand Impersonation' with the target brand identified as Bitcoin. Current HTTP status is reported as offline, suggesting the operator has taken the site down or is temporarily inactive. The available evidence points to a short‑lived infrastructure used to lure cryptocurrency‑interested victims by referencing a Bitcoin ETF narrative. While the page content has not been captured, the combination of a recent registration, Cloudflare front‑end, minimal VirusTotal detection, and inclusion on multiple blocklists provides sufficient confidence to label the domain as a Bitcoin impersonation scam.

Uncertainty remains regarding the specific phishing kit, any credential‑stealing forms, and whether additional sub‑domains are being used. Defenders should add schildvaultaris.biz to network‑level deny lists, monitor the associated IP address 188.114.97.3 for any new hostnames, and enforce URL filtering that blocks known blocklist entries.