app-thevault[.]xyz

Analysis as of July 25, 2026 indicates that the domain app-thevault.xyz was registered on February 23, 2026 through Dynadot LLC. The domain resolves to the Cloudflare IP address 188.114.96.3, which belongs to AS13335, a Cloudflare network located in the United States. DNS resolution is served by the Cloudflare authoritative nameservers miles.ns.cloudflare.com and stephane.ns.cloudflare.com, and the site was delivering traffic over HTTP/3. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming a valid certificate chain. The page title returned by the site was “The Vault”, but the site is currently taken offline, so no HTTP status code or page content can be retrieved at the time of analysis.

Security telemetry shows the domain is listed on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—and appears on four security blocklists overall. VirusTotal scans recorded three positive detections out of ninety‑three vendor submissions, reinforcing the malicious assessment. The intelligence categorises the activity as an investment scam, which aligns with the generic phishing threat type observed for the domain.

The combination of recent registration, use of a reputable CDN, a valid SSL certificate, and rapid appearance on multiple blocklists suggests a purpose‑built phishing infrastructure rather than a compromised legitimate site. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and consider adding the IP address 188.114.96.3 to any suspicious‑IP watchlists, keeping in mind that the address is shared by many Cloudflare customers. Additional investigation of any URLs that were previously resolved from the domain may be warranted, but no further content details are available.