run-indexer[.]vercel[.]app

This domain is flagged as a cryptocurrency wallet phishing site designed to harvest sensitive credentials, including private keys and recovery phrases. Analysis indicates the infrastructure mimics legitimate wallet indexing services to deceive users into entering authentication details, which are then exfiltrated to attacker-controlled servers. The threat specifically targets users of decentralized finance platforms and browser-based wallet extensions, exploiting trust in automated indexing tools to bypass security awareness. Infrastructure analysis reveals the domain resolves to IP address 64.29.17.131, hosted under AS16509 (Amazon.com, Inc.) in the United States. Despite zero detections in VirusTotal's 95-engine scan, the domain appears on three independent security blocklists, suggesting detection through behavioral or reputation-based systems rather than signature matching. The SSL certificate, issued by Google Trust Services (WR1), provides valid encryption but does not mitigate the underlying phishing threat. Registration details confirm Vercel Inc. as the hosting provider, a platform frequently abused for rapid deployment of credential-harvesting pages due to its free tier and instant provisioning. Users who have visited run-indexer.vercel.app should immediately revoke any active sessions associated with cryptocurrency wallets or exchanges. All credentials entered on the site must be considered compromised, necessitating the creation of new wallet addresses and the transfer of remaining assets to secure, unaffected storage. Browser data, including cookies and cached content, should be cleared to eliminate persistent tracking mechanisms. Additionally, affected users are advised to monitor transaction histories for unauthorized activity and enable multi-factor authentication on all related accounts where available. The domain remains active as of this assessment, requiring continued vigilance against follow-up attacks.