townsqvaults[.]xyz

townsqvaults.xyz was registered on May 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IP address 188.114.97.3, which is hosted by CloudFlare, Inc. and geolocated to Canada. The site serves HTTP content with a 200 status code and presents a TLS certificate issued by Let’s Encrypt (certificate identifier E7). These infrastructure elements are typical for rapidly provisioned malicious sites. Multiple threat intelligence sources have flagged the domain as a high‑risk phishing vector. It is currently listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that 8 of 95 security vendors have identified the domain as malicious, and the Gridinsoft trust score is 0 out of 100, indicating a strong negative reputation. The combination of a fresh registration, CloudFlare front‑end, and low trust scores aligns with the observed pattern of generic phishing campaigns that harvest credentials. Despite the clear indicators, the public‑facing content has not been captured in detail, and the specific phishing lure (e.g., credential‑stealing pages, brand impersonation) remains unknown. No malware payloads have been reported, and the site’s internal structure has not been disclosed, leaving a gap in understanding the full attack chain. The reliance on CloudFlare also obscures the origin of any backend server that may host the malicious payload. Defenders should add townsqvaults.xyz to existing URL filtering and sink‑hole rules, block the resolved IP 188.114.97.3 at the network perimeter, and monitor for outbound connections to CloudFlare edge nodes that correspond to this domain. Continuous re‑scanning with multi‑engine services is advised, as the threat landscape may evolve quickly for a domain created only weeks ago. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset passwords immediately.