Is vault-lens.com a scam? TrustSniffer's high-risk assessment: 3/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a recently launched commercial web console presented under the BlastLine name. It offers SMS, voice calls and HLR (mobile-number lookup) services from a single dashboard, and it appears to operate as a communications-services platform sold to business or developer customers. The domain name, however, carries a different brand label (a "vault" and "lens" naming) from the product name shown on the homepage.

Scam/Impersonation Risk

The assessment is cautionary because hard contradictory signals are present. Several independent security engines currently flag the domain as malicious or suspicious, including a major network-security vendor, and the combined reputation picture amounts to a confirmed blacklist listing. Together with prior phishing-related intelligence on the domain, this is the decisive factor in the assessment. The browser-behaviour testing did not independently reproduce any harmful mechanics. It found no wallet-drainer activity, no clipboard manipulation, no hidden or credential-harvesting forms, no cloaking, and only whitelisted third-party calls. Those results do not offset the external detections. A freshly registered domain whose homepage is branded as a different product is the pattern typical of disposable infrastructure, and the nature of the product raises the stakes. Bulk SMS, voice and number-lookup tooling is a service category that fraud operators routinely seek out for smishing and phone-number validation. No conflicting legal entities were found, so there is no identity contradiction, and no on-page impersonation of a named third-party brand was recorded. The risk rests on external detections and provenance, not on proven identity fraud. Evidence:

• Homepage: the page title presents "BlastLine — SMS, calls and HLR in one console", while the domain name suggests an unrelated brand.
• Reputation checks: 3 engines rated the domain malicious and 2 suspicious. One of them is a major network-security vendor, and external blacklist status is confirmed.
• Domain registration: created 2026-08-04 (~0.23 years old), so a very young domain.
• Web archive: a single snapshot captured in 2026 (1 year tracked), so there is no established history.
• Browser behaviour testing: 3 of 3 runs completed with no wallet, clipboard, hidden-form or cloaking activity, and 3 console errors on load.

Regulatory Verification Notes

The homepage markets a telecommunications-adjacent messaging service but gives no usable evidence of a licence, a registered legal entity or a regulator relationship. Disclosure on the captured pages is unclear, so the site's regulatory standing cannot be confirmed from on-site evidence. For a service that sends messages to third-party subscribers and queries subscriber-number data, the absence of a visible operator identity is a material gap. It is a verification gap, not a finding in itself, but here it sits alongside confirmed external detections. No third-party broker or regulator record matches the site, and the absence of a match confirms nothing either way. The domain's registration shows only a generic administrative registrant, with no named operating company, which gives no basis for linking the site to the BlastLine brand. Evidence:

• Homepage: the console-style presentation names no operating company, licence or registration reference.
• Registration record: registrar Atak Domain, registrant listed as "Domain Administrator", expiry 2027-08-04.
• Transport encryption: a domain-validated certificate issued by WE1, valid to 2026-12-31. This proves only encryption, not operator identity.

What to Verify Next

Any engagement should begin by establishing that the BlastLine brand is genuinely connected to this domain. That means locating the brand's official website independently and checking whether it lists this domain, instead of following links or credentials supplied by the site. The prospective customer should also request the operator's registered company name and the telecom or messaging-provider licensing that applies in the relevant jurisdiction, and check these against the official registry. Any contact, billing or support channels should be confirmed through an independent route. Until the external detections are resolved, the site should be treated as unfit for account creation, credential entry or payment. Evidence:

• Homepage: the brand shown differs from the domain label, so the link between them needs independent confirmation.
• Domain registration: the domain is about 83 days old, with no multi-year operating record to rely on.
• Threat listings: the external detections were recorded on the current domain and have not been shown to be cleared.

Summary Verdict

The site is assessed as high risk. Confirmed external threat detections, a very young domain and a lack of any independently verifiable operator identity outweigh the clean technical hygiene observed. The available evidence supports only read-only observation. It does not support login, credential, or financial interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN/WAF, and all observed addresses are shared edge servers on the same network, so the real hosting origin cannot be seen. This visibility limit prevents independent verification of where the content is hosted and can mask rapid content swaps. The protection is a mitigating factor only, not evidence of legitimacy, and it does not offset the reputation risk. Abuse reports exist against one edge address, but they relate to shared provider infrastructure and are discounted. The young-domain DNS pattern with sparse subdomains is an unconfirmed heuristic and carries little weight on its own. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US) across 4 edge addresses, with no origin candidate observed.
• Abuse reports: 7 reports against a shared CDN edge address, a low confidence rating and a whitelisted provider, so they are discounted.

Closing Assessment

Do not log in, supply credentials, make payments or send customer data to this site. Any interaction should be limited to passive viewing from an isolated environment, and it should stay that way until the external detections are cleared and the operator has been identified through independent means.

Signals weighed against the site

• AbuseIPDB: 7 reports on hosting IP 2a06:98c1:3120::1 (Cloudflare, Inc., Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.