vaultfunded[.]app

Analysis of vaultfunded.app shows a short‑lived domain created on 21 February 2026 and registered through NiceNIC International Group Co., Limited. The authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com, and the domain resolves to the IP address 76.76.21.22, which belongs to AS16509 Amazon.com, Inc. The hosting environment is identified as Vercel and the site enforces HTTP Strict Transport Security (HSTS). No TLS certificate was presented, and an HTTP request to the root returned a 404 status code, indicating that the expected content is not served.

The page title returned by the server reads "VaultFunded - Get Up to $200K in Trading Capital | Prop Trading Challenges," which aligns with the classified scam type of an investment scam. Security telemetry shows the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans reported that two of ninety‑three antivirus engines flagged the domain, reinforcing the suspicion of malicious intent.

The current operational status is offline, but the infrastructure footprint remains observable. Defenders should add the IP 76.76.21.22 to network‑level deny lists, enforce blocking of the domain at proxy and DNS layers, and monitor for additional Vercel‑hosted assets that share the same nameserver set. Continuous re‑evaluation is advised, as the lack of a TLS certificate and the 404 response limit immediate content analysis, leaving the exact phishing payload unknown.