join-vaulto[.]com

Analysis of join-vaulto.com indicates an active credential-theft phishing campaign targeting users under the pretext of a service branded as 'Vaulto.' The domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to IP address 188.114.97.3, which has been linked to multiple phishing operations in recent months. As of July 12, 2026, the site remains operational, with a page title explicitly displaying 'Vaulto — Join,' suggesting an attempt to lure victims into submitting sensitive credentials. Security vendor detection is limited but notable: five of 95 engines on a widely used threat intelligence platform flag the domain as malicious. Additionally, the domain appears in 23 threat intelligence pulses on a major open-source threat exchange, indicating cross-industry recognition of its malicious nature. It is currently blocked by at least two security blocklists, further corroborating its classification as a high-risk asset. The SSL certificate, issued by Google Trust Services, provides no inherent legitimacy, as phishing domains routinely employ valid certificates to evade initial suspicion. While the exact nature of the phishing kit or targeted brand beyond the 'Vaulto' identifier is not yet confirmed, the domain’s infrastructure and detection patterns align with credential-harvesting campaigns. Defenders are advised to treat this domain as an active threat, implement immediate blocking at the DNS or network level, and monitor for related indicators of compromise. Given the domain’s persistence and registration age, it is likely part of a broader, sustained phishing operation rather than an opportunistic attack.