walletgo-demo-nextjs[.]vercel[.]app

Analysis of walletgo-demo-nextjs.vercel.app indicates an active crypto drainer campaign targeting users through a domain hosted on Vercel infrastructure. The subdomain, registered under the parent domain vercel.app, resolves to IP address 64.29.17.131 and was created on February 21, 2026, via registrar Tucows Domains Inc. The page title 'Ronin Playground' suggests an association with blockchain or cryptocurrency environments, though the exact content and targeting mechanisms remain unverified due to limited on-site analysis. Security vendors have flagged the domain with varying levels of detection: six of 95 engines on VirusTotal identify the domain as malicious, while three independent security blocklists include it in their denylists. The domain is actively blocked by multiple browser-based security tools, reinforcing its classification as a high-risk threat. Infrastructure analysis reveals the use of Node.js, React, Next.js, and Webpack, alongside HSTS implementation and a valid SSL certificate issued by Google Trust Services. Despite these legitimate-seeming technical attributes, the domain's Gridinsoft trust score of 0/100 aligns with its malicious classification. Defenders should prioritize blocking or monitoring access to this domain, particularly in environments where cryptocurrency transactions occur. The domain remains active as of July 12, 2026, and no takedown efforts have been observed. Further investigation into associated wallet addresses or backend infrastructure may yield additional indicators of compromise, though such details are not currently available in public threat feeds.