portalveicularesdoestsc[.]vercel[.]app

PhishDestroy identifies the domain portalveicularesdoestsc.vercel.app as an active cryptocurrency drainer kit deployed on Vercel’s platform. The threat actor impersonates a legitimate Portuguese vehicle portal, likely targeting cryptocurrency holders with fraudulent payment or wallet connection prompts. This domain is part of a broader campaign observed in early 2024, where threat actors abuse Vercel’s free hosting to deploy drainers under seemingly benign subdomains. The infrastructure leverages Vercel’s default SSL certificates issued by Google Trust Services, adding a veneer of legitimacy to phishing lures. Based on telemetry, the drainer kit is designed to siphon cryptocurrency from unwitting users who interact with wallet connection prompts or fake payment gateways hosted on this domain.

Technical indicators confirm this domain’s malicious intent. VirusTotal currently reports 1 out of 95 detection engines flagging the domain as malicious, suggesting a low initial detection rate. The domain resolves to IP address 216.198.79.67, which is hosted on Vercel’s infrastructure. The domain was registered through Vercel Inc., utilizing their free tier hosting service—commonly exploited by threat actors for its low barrier to entry and rapid deployment capabilities. The SSL certificate, issued by Google Trust Services, adds authenticity to phishing pages, while the domain’s recent creation date (not specified but inferred as recent due to active status) indicates a transient nature typical of drainer campaigns. Google Safe Browsing (GSB) has not yet flagged this domain, and no public blocklists currently include it, leaving users unprotected by default browser or security tooling.

This domain remains active as of the latest assessment, with no takedown or remediation observed. PhishDestroy flags it as under investigation, with a risk level pending further analysis. Immediate action is advised: block traffic to 216.198.79.67 and portalveicularesdoestsc.vercel.app at the network perimeter or via DNS sinkholing. Users should avoid interacting with any wallet prompts or payment gateways associated with this domain. Security teams are encouraged to monitor for related domains leveraging Vercel’s infrastructure and report findings to threat intelligence platforms to improve detection coverage. The low VT detection rate underscores the need for proactive hunting and behavioral analysis to identify similar campaigns before they escalate.