vaultonic[.]shop

The domain vaultonic.shop is identified as a brand impersonation threat, specifically targeting the financial services company Revolut. This domain is part of a broader campaign designed to deceive users into providing sensitive information, such as login credentials and financial data, by mimicking the appearance and functionality of legitimate Revolut services.

Infrastructure analysis reveals that vaultonic.shop has a VirusTotal detection score of 12/95, indicating that 12 out of 95 security vendors have flagged this domain as malicious. The domain is registered through Gname.com Pte. Ltd. and resolves to the IP address 104.21.93.174, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on February 24, 2026, and is currently flagged by Google Safe Browsing as a phishing site. Additionally, the domain appears on 3 security blocklists, further corroborating its malicious nature.

The domain is currently offline, and response actions have been taken to mitigate the threat. However, the offline status does not eliminate the risk entirely, as the domain could be reactivated at any time. Users are advised to remain vigilant and avoid interacting with any links or communications that lead to this domain. Organizations should update their security policies and blocklists to ensure that this domain remains inaccessible to their network users. Continuous monitoring is recommended to detect any potential reactivation or related malicious activities.