listed-livegrabs48[.]vercel[.]app

This domain, listed-livegrabs48.vercel.app, poses a high-risk threat as a crypto credential theft operation. Analysis indicates the site was designed to impersonate legitimate cryptocurrency platforms, tricking users into entering sensitive wallet credentials or private keys. Once compromised, attackers gain direct access to digital assets, enabling unauthorized transfers and irreversible financial losses. The threat specifically targets users of decentralized applications and wallet services, exploiting trust in familiar interfaces to facilitate theft. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on February 21, 2026, through Tucows Domains Inc., an unusually future-dated creation that aligns with known evasion tactics. It resolves to IP address 64.29.17.195, hosted on Amazon Web Services (AS16509), a common infrastructure choice for phishing campaigns due to its scalability and reputation. The SSL certificate, issued by Google Trust Services, provides a false sense of security while the site remains flagged by 17 out of 95 security vendors on VirusTotal. Additionally, five independent security blocklists, including PhishDestroy and PhishingDB, have classified this domain as malicious, further validating its fraudulent nature. Users who visited listed-livegrabs48.vercel.app should take immediate action to mitigate potential damage. First, disconnect any connected wallets or sessions from the site and revoke all permissions granted to unknown or suspicious applications. Next, conduct a full security audit of all linked devices, scanning for malware or unauthorized access. If credentials were entered, transfer all digital assets to a new, secure wallet and monitor transaction histories for unauthorized activity. Report the incident to relevant platform security teams and consider filing a report with local cybercrime authorities. Given the domain's current offline status, users should remain vigilant for similar threats, as attackers often redeploy infrastructure under new domains.