vaultswallet[.]app

Vaultswallet.app was registered on 2026-01-11 through Hosting Concepts B.V. d/b/a Registrar.eu. The authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com, which are typical of parked domains. DNS resolution points to 82.198.227.198, an IP address associated with a hosting provider that frequently appears in malicious infrastructure reports. The domain is currently listed on a single public security blocklist and has been flagged by PhishDestroy as a crypto‑drainer site. VirusTotal analysis shows that 1 of 91 scanned security vendors returned a positive detection, indicating that at least one AV engine identified malicious behavior.

No additional public reputation services (Safe Browsing, OTX, etc.) have published a verdict for this host, and the site does not appear to have an SSL certificate or a reachable HTTP endpoint in the available data. The limited visibility suggests that the infrastructure is intentionally minimal, likely to evade automated crawling while still delivering a payload to targeted victims. Given the evidence, the domain should be treated as high‑risk. Defenders should add 82.198.227.198 to network‑level blocklists, deny outbound connections to the domain, and monitor DNS queries for vaultswallet.app and its associated parking nameservers.

Email security gateways should be updated to flag any messages containing the domain or links to it. Because the site is still active despite being blocked by PhishDestroy, continuous re‑evaluation of the blocklist status is recommended. Organizations using threat‑intel platforms should ingest the single detection from VirusTotal and the blocklist entry to enrich their detection rules. Until further analysis (e.g., HTTP response, page content) becomes available, the domain remains a suspected crypto‑drainer that could attempt to steal cryptocurrency credentials or redirect victims to malicious wallets.