walrus-clone[.]vercel[.]app

This domain, walrus-clone.vercel.app, is identified as a high-risk crypto drainer phishing operation targeting users of the Walrus Wallet cryptocurrency platform. The site employs a cloned interface to deceive victims into connecting their wallets, enabling unauthorized transaction signing and subsequent fund drainage. The page title, wal-rus-clone, suggests deliberate impersonation, while the domain structure leverages Vercel's hosting to lend superficial legitimacy. No specific drainer kit has been conclusively attributed at this time, though the behavioral pattern aligns with known wallet-draining frameworks. Analysis indicates the domain was registered on March 14, 2026, and currently resolves to the IP address 64.29.17.195, associated with AS16509 (Amazon.com, Inc.) in the United States. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WR1), a common feature in phishing infrastructure to evade basic security warnings. The domain appears on three security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL, indicating prior identification and community-level mitigation efforts. No Google Safe Browsing (GSB) listing is currently reported. As of the latest verification, walrus-clone.vercel.app remains active, posing an ongoing threat to cryptocurrency users. The hosting provider, Vercel, has not yet taken enforcement action, though the domain's presence on multiple blocklists may limit its reach. The risk level remains high due to the targeted nature of the attack and the potential for irreversible financial loss. Users are advised to verify wallet connection prompts against official sources, employ hardware wallets for high-value transactions, and cross-reference domain authenticity via multiple threat intelligence feeds. Network-level blocking of the IP 64.29.17.195 and domain-based filtering are recommended for enterprise environments.