blockchain-clone-lyart[.]vercel[.]app

The domain blockchain-clone-lyart.vercel.app was registered on October 06, 2025 through Vercel Inc. and resolves to IP address 64.29.17.3, which belongs to AS16509 Amazon.com, Inc. in the United States. The site serves content over HTTPS using a certificate issued by Google Trust Services (WR1) and enforces HSTS. The HTTP response code is 200 and the page title returned is "Blockchain Clone". Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category, and the domain appears on two public security blocklists, specifically PhishDestroy and PhishingDB. VirusTotal reports that 20 out of 95 security vendors have flagged the domain, while reputation services assign extremely low trust scores (Gridinsoft 0/100, Scamadviser 1/100). The threat is identified as a high‑risk brand‑impersonation campaign targeting Blockchain.com. Infrastructure analysis indicates no additional infrastructure beyond the Vercel hosting environment, and the SSL certificate chain appears legitimate, suggesting the attackers leveraged a trusted hosting provider to increase credibility. Content beyond the page title has not been publicly disclosed, so the exact phishing payload remains unknown. Defenders should immediately block the domain and its resolved IP at network perimeter devices, add the host to email and web filtering deny‑lists, and monitor for any DNS queries to the IP range associated with AS16509. User awareness campaigns should highlight that the malicious site mimics Blockchain.com and that any unsolicited requests for cryptocurrency credentials are likely fraudulent. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this campaign.