vaults-locus[.]finance

Analysis indicates that vaults-locus.finance is an active malicious site classified as a crypto‑drainer phishing operation. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare’s network (AS13335). DNS resolution points to IP 188.114.97.3, located in the United States, and the nameservers listed are coleman.ns.cloudflare.com and indie.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 label, but HTTP requests return a 403 status code, suggesting the page is deliberately restricted to unauthorized visitors. The page title observed is “Un instant…”, and no further content has been publicly disclosed.

Security‑vendor scanning on VirusTotal shows 7 of 93 scanners flagging the domain, indicating a moderate level of detection across the community. Additional reputation services report a Gridinsoft trust score of 0 / 100 and the domain appears on a single blocklist. PhishDestroy has already added the domain to its blocklist, and the same blocklist entry is reflected in the current security feed. Detected technologies include HSTS, Cloudflare Browser Insights, Cloudflare services, and HTTP/3, all of which are typical for sites leveraging Cloudflare’s edge platform.

The combined evidence—recent creation date, registration through a known registrar, hosting on Cloudflare, low trust score, detection by multiple vendors, and active blocklist listings—supports a high‑risk assessment. Uncertainty remains regarding the exact payload or phishing pages because the site’s content has not been captured beyond the title. Defenders should block the domain at network perimeter, add it to URL filtering rules, monitor DNS queries for the associated IP and nameservers, and consider sharing the indicator set with threat‑intel communities. Ongoing observation is recommended to detect any changes in hosting or content that could affect mitigation strategies.