autoclaimtoken-incbc4mu7-autoclaimtokens-projects[.]vercel[.]app

Analysis on 2026-07-25 indicates that the domain autoclaimtoken-incbc4mu7-autoclaimtokens-projects.vercel.app is currently offline but was previously hosted on Vercel infrastructure, resolving to IP 64.29.17.195 owned by Amazon.com, Inc. (AS16509) in the United States. The TLS certificate presented by the site was issued by Google Trust Services under the WR1 intermediate, confirming the use of a legitimate certificate authority but not implying legitimacy of the content. An HTTP 404 response was observed, suggesting that the original malicious page may have been removed or that the domain was configured to return a not‑found status after takedown. The page title captured during the short live period read “CryptoRecover – Professional Asset Recovery,” and the threat classification in the intelligence labels the campaign as a crypto scam that impersonates the Trust Wallet brand.

Google Safe Browsing flagged the domain for social engineering, and the site appears on a single security blocklist, indicating limited but confirmed detection by external services. VirusTotal scans reported 11 detections out of 95 antivirus engines, reinforcing the malicious intent despite the relatively low detection count. Registration information lists Vercel Inc. as the registrar, which aligns with the observed hosting platform but provides no additional attribution.

The domain was also blocked by PhishDestroy, confirming that at least one dedicated anti‑phishing service took mitigation action. Uncertainty remains regarding the exact phishing landing page content, the distribution vectors used, and whether additional infrastructure (such as command‑and‑control servers) was associated with the campaign, as no further intelligence was disclosed.