claim-retikrewards[.]vercel[.]app

Analysis conducted on July 23, 2026 identifies claim-retikrewards.vercel.app as a confirmed crypto‑drainer infrastructure. The site returned HTTP 451, indicating a legal restriction response, and served the page title “Retik on Ethereum – The Retik is here,” which aligns with the listed scam type of “Crypto Scam”. DNS resolution points to 64.29.17.131, an address owned by Amazon.com, Inc. (AS16509) and geolocated to the United States. The domain was registered on February 21, 2026 through Tucows Domains Inc., a registrar frequently observed in abuse cases.

SSL certification is provided by Google Trust Services under the WR1 certificate, and the server advertises HSTS, confirming the use of modern web security headers despite the malicious intent. VirusTotal records show that seven of ninety‑three scanning engines flagged the domain as malicious, reinforcing the suspicion. Independent blocklists PhishDestroy, ScamSniffer and Enkrypt have all listed the domain, and it appears on three additional security blocklists, demonstrating consensus among threat‑intelligence feeds. The site is currently taken offline, yet the infrastructure—particularly the hosting on Vercel and the Amazon IP—remains reusable for future campaigns.

Uncertainty remains around the exact payload delivered to victims, as no page content beyond the title has been captured. Defenders should continue to block the domain and its resolved IP at perimeter defenses, monitor for re‑registration or new subdomains on the same IP range, and update endpoint protection signatures with the observed VirusTotal detections. Attribution to a specific malware kit cannot be made at this time, but the observed patterns are consistent with previously documented crypto‑drainer operations.