wallet-kosh[.]vercel[.]app

This domain, wallet-kosh.vercel.app, is flagged as a high-risk brand impersonation threat targeting Ethereum users. Analysis indicates the site operates as a crypto drainer, designed to mimic legitimate Ethereum wallet interfaces to deceive victims into authorizing malicious transactions. The page title 'Kosh' and visual design elements closely resemble official Ethereum branding, increasing the likelihood of successful social engineering attacks. No specific drainer kit signature has been identified in public repositories, but behavioral patterns align with known wallet-draining malware families. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through Tucows Domains Inc., and currently resolves to IP address 64.29.17.131 (AS16509, Amazon.com, Inc., US). The SSL certificate is issued by Google Trust Services (WR1), a common characteristic of both legitimate and malicious deployments. VirusTotal returns 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged by automated scanning systems. However, it appears on 4 security blocklists, including entries from PhishDestroy, Polkadot, Enkrypt, and Codeesura. Google Safe Browsing status is not provided, but the domain's presence on multiple specialized blocklists indicates active malicious classification. The domain remains operational as of this assessment, posing an ongoing risk to Ethereum users. Response actions by security providers have included blocklisting, but the site continues to resolve and serve content. The discrepancy between VirusTotal's 0/95 detection rate and the 4 blocklist entries suggests the threat may evade generic detection mechanisms while being identified by specialized crypto-focused security tools. Users are advised to treat any interaction with wallet-kosh.vercel.app as high-risk, particularly transactions involving wallet connections or token approvals. Network-level blocking of the IP 64.29.17.131 and monitoring for related subdomains under vercel.app are recommended defensive measures.