run-scanner[.]vercel[.]app

This domain, run-scanner.vercel.app, is identified as an active crypto drainer phishing site targeting cryptocurrency wallet credentials and funds. Analysis indicates the infrastructure is designed to mimic legitimate wallet scanning services, tricking users into authorizing malicious transactions that drain assets from connected wallets. The domain remains operational as of this report, with no observed takedown efforts. Infrastructure analysis reveals the domain was registered through Vercel Inc., a platform commonly used for rapid deployment of web applications. It resolves to the IP address 64.29.17.67, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Despite its malicious intent, the domain has not been flagged by any of the 95 security vendors on VirusTotal, indicating either recent deployment or evasion techniques. The SSL certificate, issued by Google Trust Services (WR1), provides a veneer of legitimacy. The domain appears on three independent security blocklists, suggesting detection by specialized phishing and cryptocurrency threat intelligence feeds. The current risk level is assessed as high due to the domain's active status, lack of widespread detection, and direct financial threat to users. Organizations and individuals are advised to block the domain and IP address at the network level. Users should verify wallet addresses and transaction requests through official channels before approval. Cryptocurrency service providers are recommended to monitor for interactions with this domain and implement additional authentication steps for high-value transactions. Given the domain's hosting on a legitimate platform, vigilance in monitoring for similar patterns is critical to mitigating further exposure.