schildvaultarisbe[.]com

Analysis indicates that schildvaultarisbe.com is an active fraudulent domain classified as an investment scam, specifically targeting users in Belgium. The domain was registered on March 12, 2026, through a registrar known for low-cost, high-volume registrations, a common pattern among threat actors. Infrastructure analysis reveals the use of Cloudflare nameservers (katelyn.ns.cloudflare.com and randy.ns.cloudflare.com) and resolution to IP address 188.114.96.3, which is part of Cloudflare's network (AS13335). The site employs a Let's Encrypt SSL certificate and is built on WordPress, a widely used content management system often exploited in phishing operations due to its accessibility and plugin vulnerabilities. The page title, 'Schild Vaultaris — Officiële platformwebsite in België,' suggests an attempt to impersonate an official platform operating in Belgium, though no legitimate entity by that name has been confirmed in public records. The presence of Yandex.Metrika and Google Analytics indicates tracking mechanisms are in place, likely to monitor victim engagement and optimize fraudulent campaigns. Security vendors have flagged this domain, with 15 out of 94 detecting it as malicious on VirusTotal. Additionally, the domain appears in 23 threat intelligence pulses on AlienVault OTX and is blocked by multiple security blocklists, including PhishDestroy, MetaMask, and SEAL. Defenders should treat this domain as high-risk. The combination of recent registration, Cloudflare obfuscation, tracking tools, and broad detection by security vendors provides strong evidence of malicious intent. Organizations are advised to block resolution to the IP address 188.114.96.3 and monitor for any attempts to access or interact with this domain. While the exact mechanics of the scam remain unconfirmed without further analysis, the infrastructure and intelligence align with known investment fraud tactics targeting European users.