investmentvault[.]top

investmentvault.top is a newly registered domain (created 9 June 2026) that has been observed in active phishing infrastructure. The domain is hosted on Cloudflare DNS (nameservers dylan.ns.cloudflare.com and raina.ns.cloudflare.com) and resolves to the IP address 188.114.97.3. The registrar listed is NameSilo, LLC. The domain has been added to one security blocklist and is currently blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has identified it as malicious. VirusTotal shows that the domain was scanned by 91 AV engines, none of which reported a detection at the time of analysis; this absence of detections does not constitute evidence of safety, as the URL may still host malicious content that evades current signatures.

No public web content, page title, or SSL certificate details have been captured, so the exact phishing lure or target brand remains unknown. The lack of visible branding or page analysis means that defenders cannot rely on visual cues to identify the campaign; instead, the observable infrastructure attributes should be used for detection. The single blocklist listing suggests limited exposure, but the active status and recent creation date imply that the domain could be used in short‑lived campaigns aimed at bypassing reputation‑based filters. Defenders should add 188.114.97.3 to network‑level deny lists, block DNS queries for investmentvault.top, and monitor traffic to Cloudflare name servers associated with the domain.

Email security gateways should be configured to flag any messages containing URLs that resolve to this domain. Continuous re‑scanning on multi‑engine platforms is recommended to capture any future detections. Because the domain’s content has not been publicly examined, analysts should treat any observed traffic as potentially malicious until a thorough content review confirms otherwise.