tlnvault[.]com

tlnvault.com was registered on September 29, 2025 through NameCheap, Inc. The domain resolves to the Cloudflare‑owned address 172.67.171.125, which is associated with ASN 13335 in the United States. No TLS certificate is presented, and the web server returns HTTP 200 for the root page, whose title is “Treeline Financial Coaching（TLN）”. The site is listed on a single security blocklist and is explicitly blocked by the PhishDestroy feed. VirusTotal reports three detections out of ninety‑five scanning engines, confirming that at least a minority of AV products consider the host malicious. Independent reputation services assign a Gridinsoft trust score of 1 / 100, indicating a near‑certain malicious classification.

The authoritative name servers are chin.ns.cloudflare.com and vick.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure. The observed activity matches a documented investment‑scam campaign, and the domain is currently marked as active with a high risk rating. Defenders should treat any traffic to or from tlnvault.com as suspicious. Email gateways, web proxies, and endpoint protection should block the domain and its resolving IP address. Network defenders should add the IP 172.67.171.125 to deny lists, while also monitoring for other Cloudflare‑hosted addresses that may be leveraged by the same actors.

Because the site lacks a valid TLS certificate, attempts to establish encrypted sessions will fail, providing an additional indicator for detection. Continuous monitoring of the registrar NameCheap for new domains that share similar naming patterns is recommended, as the threat actor may reuse the same registration service for future campaigns. Incident responders should collect the full HTTP response, page title, and any redirects for forensic correlation with existing threat‑intel feeds. The combination of low trust score, multiple vendor detections, and blocklist inclusion justifies immediate containment and remediation actions.