token-gated-dao[.]vercel[.]app

This domain, token-gated-dao.vercel.app, poses a high-risk credential harvesting threat by impersonating Twitter’s authentication infrastructure. Analysis indicates the site mimics Twitter’s login interface to deceive users into submitting account credentials, which are then captured by threat actors. The domain is designed to exploit trust in decentralized autonomous organization (DAO) terminology, a tactic observed in targeted phishing campaigns against cryptocurrency and social media users. Infrastructure analysis reveals the domain was registered on March 13, 2026, through Vercel Inc., and currently resolves to the IP address 216.198.79.67, hosted on Amazon’s AS16509 network. It appears on three security blocklists, including PhishDestroy and MetaMask, and is flagged by 8 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend legitimacy to fraudulent sites. The domain remains active, with no takedown observed as of the latest verification. Users who visited token-gated-dao.vercel.app should immediately revoke any active sessions on Twitter and reset their account credentials using a secure, unrelated device. Enable multi-factor authentication (MFA) with an app-based or hardware token, not SMS, to mitigate further risk. Monitor the account for unauthorized activity, including posts, messages, or linked applications. If financial or cryptocurrency transactions were initiated through the site, report the incident to relevant platforms and consider freezing associated accounts. Network administrators should block the domain and its resolving IP (216.198.79.67) at the perimeter to prevent further exposure.