drain-phi[.]vercel[.]app

This domain, drain-phi.vercel.app, is currently flagged as an active crypto drainer phishing site. Analysis indicates it is specifically designed to exfiltrate cryptocurrency wallet credentials and drain funds from connected accounts. The page title 'Drain' and infrastructure patterns align with known crypto theft operations, posing a direct financial risk to users who interact with it. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc. It resolves to IP address 216.198.79.195, hosted on AS16509 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WR1). Despite its malicious intent, the domain has not yet been flagged by security engines, with 0/95 detections on VirusTotal. It appears on one security blocklist and is currently blocked by PhishDestroy. The domain remains active as of this report. Mitigation requires immediate action from security teams and end users. Network administrators should block the domain drain-phi.vercel.app and its resolving IP 216.198.79.195 at the firewall or DNS level. Users must avoid connecting wallets or entering credentials on any site matching this domain. Cryptocurrency holders should revoke any previously granted permissions to unknown or suspicious domains. Security teams are advised to monitor for connections to this IP and domain across logs, particularly in web proxy and DNS query data. Given the zero-detection status on VirusTotal, manual detection rules should be implemented to identify related infrastructure.