ofvault[.]live

The domain ofvault.live is currently flagged as an active generic phishing infrastructure and remains under investigation. It appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has identified it as malicious. VirusTotal records show that the domain was scanned by 91 separate analysis engines, none of which reported a detection at the time of the scan; this absence of detections does not constitute evidence of benign behavior and should be interpreted with caution.

No additional public data such as Safe Browsing entries, Open Threat Exchange references, registrar details, hosting IP, SSL certificate information, HTTP response codes, trust‑score metrics, or page‑title content has been disclosed in the available intelligence. Consequently, the precise hosting environment, certificate usage, and page content remain unknown. Defenders should treat the domain as hostile: enforce network‑level blocks, add it to internal deny lists, and monitor outbound connections for attempts to resolve or contact the domain.

Where possible, perform active probing in a controlled environment to capture any payloads or redirects, and correlate logs for signs of credential harvesting attempts targeting users. Continuous re‑evaluation is advised, as further indicators such as malware payloads, additional blocklist listings, or detection vendor updates may emerge as the investigation proceeds.