vulcan[.]asset-pass[.]xyz

This domain, vulcan.asset-pass.xyz, is flagged as a credential harvesting page targeting users of the Vulcan platform. Analysis indicates the site mimics the legitimate Vulcan login interface, presenting a fraudulent portal designed to capture user credentials. The threat type is classified as a fake login page, a common tactic in phishing campaigns aimed at stealing sensitive account information. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft operations targeting web-based platforms. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain resolves to IP address 172.67.196.43 and was registered on July 26, 2025, through Web Commerce Communications Limited. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer. No entries were found in Google Safe Browsing at the time of assessment, though this does not preclude prior or intermittent malicious activity. The domain has been taken offline, reducing immediate exposure to potential victims. However, the infrastructure remains a latent risk, as threat actors may reactivate or repurpose the domain for future campaigns. Users who accessed the site prior to takedown should assume credential compromise and initiate password resets on all associated accounts. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate follow-on phishing operations. Proactive blocking of the domain and its associated IP is recommended to prevent resurgence.