wind-power-coral[.]vercel[.]app

This domain, wind-power-coral.vercel.app, is identified as a high-risk crypto drainer phishing endpoint designed to harvest wallet credentials and execute unauthorized transactions. Analysis indicates the infrastructure mimics legitimate decentralized application interfaces, employing social engineering tactics to deceive users into connecting wallets. No explicit brand impersonation is observed, but the domain leverages generic crypto-themed lures to maximize victim engagement. The presence of a 404 page suggests either a staging phase or rapid takedown evasion, a common tactic in transient phishing operations. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 23, 2026, though the creation date may reflect backdated records or registrar delays. It resolves to the IP address 216.198.79.3, hosted on AS16509 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WR1), providing a superficial layer of legitimacy. Detection metrics show 15 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on three distinct security blocklists. Google Safe Browsing status remains unconfirmed but is likely flagged given the detection volume. As of the latest assessment, the domain remains active despite its 404 status, indicating potential backend functionality or preparation for redeployment. Response actions by security entities include blocking by at least three major threat intelligence platforms. The remaining risk is classified as high due to the domain's association with crypto drainer activity, transient hosting patterns, and low detection thresholds. Organizations and users are advised to enforce DNS-level blocking, monitor wallet transactions for anomalies, and verify domain authenticity before interacting with crypto-related prompts.