vaulta-scan[.]com

vaulta-scan.com is currently listed as offline but historical observations indicate it was used as a crypto‑related phishing site. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to 172.67.145.31, an address owned by Cloudflare (AS13335) in the United States. DNS resolution is served by the Cloudflare nameservers bethany.ns.cloudflare.com and nero.ns.cloudflare.com, and the site was delivered over HTTP/3 behind Cloudflare’s edge network. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming the use of a legitimate certificate chain but not the legitimacy of the hosted content. Page metadata shows the title “Vaulta Network – Enterprise‑Grade Blockchain Infrastructure”, which aligns with the declared scam type of a crypto scam.

Front‑end libraries detected include Three.js, Chart.js and assets served from jsDelivr, while Cloudflare Browser Insights was also observed, suggesting a fairly modern web stack. VirusTotal recorded detections from 7 of 93 scanning engines, and the domain appears on a single external blocklist. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has actively blocked it. Independent scoring from Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. The combination of a recent registration date, low reputation scores, multiple vendor detections, and inclusion on reputable blocklists indicates a high likelihood that the site was designed to lure victims into cryptocurrency‑related fraud.

At present, no additional intelligence such as phishing page screenshots, credential harvesting behavior, or malware payloads has been released, leaving the exact victim interaction flow uncertain. Defenders should continue to block vaulta-scan.com at perimeter filters, update DNS blacklists, and monitor for any resurgence of the domain or its associated IP address.