vulcan[.]pass-bots[.]xyz

On 24 July 2026 analysts observed that the domain vulcan.pass-bots.xyz is currently offline but was previously identified as a wallet/seed phishing site that impersonates Discord. The site was registered on 21 February 2026 through Tucows Domains Inc. and resolved to the Cloudflare‑owned address 172.67.146.159, which is announced by AS13335 in the United States. DNS resolution used the Cloudflare nameservers colette.ns.cloudflare.com and remy.ns.cloudflare.com, and HTTP traffic was served over HTTP/3 with a Google Trust Services/WE1 certificate. An HTTP request returned a 403 status code, and the page title reported by the crawler was “Vulcan Account | Vulcan”.

Security‑monitoring services PhishDestroy and ScamSniffer have already taken the domain offline, and it appears on two public blocklists. Independent scanning on VirusTotal recorded detections by eight of ninety‑three antivirus engines, indicating that the domain is recognized as malicious by multiple vendors. The Gridinsoft trust score of 0 / 100 further confirms a lack of legitimacy. Because the domain is hosted behind Cloudflare, attribution of the underlying server is obscured, and the precise phishing kit or credential‑harvesting page content has not been publicly disclosed.

The combination of brand impersonation (Discord), wallet/seed phishing classification, and a low‑trust SSL environment suggests the operator intended to lure Discord users into revealing private keys or seed phrases. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the host or similar sub‑domains under the same registrar, and enforce awareness training that warns users against unsolicited requests for wallet seeds claiming to be from Discord. Ongoing threat‑intel feeds should be checked for re‑use of the Cloudflare IP range or the same nameserver pair, as these indicators have been used in recent phishing campaigns.