tiltvault[.]com

Analysis of tiltvault.com, registered through NameCheap, Inc. on February 21, 2026, shows a newly created domain that resolves to the IP address 216.150.1.1, hosted within Amazon’s AS16509 network in the United States. The site serves content over HTTPS using a Let’s Encrypt R12 certificate and enforces HTTP Strict Transport Security, indicating an attempt to appear legitimate. Front‑end technology fingerprints reveal deployment on Vercel, email handling via Mailgun, and the inclusion of Google Tag Manager, all common to legitimate services but also frequently abused by malicious operators. The page title advertises “TiltVault — Omnichain Treasury Infrastructure for Institutions,” yet the domain is classified as an investment‑type phishing campaign.

Threat intelligence shows the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, while Gridinsoft assigns it a trust score of 0 out of 100. VirusTotal scans have flagged the domain by 15 of 93 security vendors, reinforcing the suspicion of malicious activity. DNS configuration includes registrar‑provided nameservers pdns1.registrar-servers.com and pdns2.registrar-servers.com, and MX records point to smtp.google.com and an incomplete mx2.priva entry, suggesting attempts to control email delivery. HTTP response code is 200, confirming the site is reachable and actively serving content.

While the observed infrastructure and vendor detections provide strong indicators of a phishing operation targeting investors, the lack of publicly available payload samples or page content analysis leaves the exact modus operandi unclear. Defenders should block the domain at network and email gateways, monitor for outbound connections to the associated IP, and enforce strict email authentication for any messages claiming to originate from tiltvault.com. Ongoing surveillance of threat feeds for additional indicators is recommended to capture any evolution of the campaign.