aitrader3-repo[.]vercel[.]app

This domain, aitrader3-repo.vercel.app, is flagged as an active high-risk phishing resource specializing in brand impersonation targeting MetaMask cryptocurrency wallet users. Analysis indicates the site presents a fraudulent interface mimicking the legitimate MetaMask platform, likely designed to harvest wallet credentials, seed phrases, or private keys through deceptive input fields. The page title, CODE COMPILER, suggests an attempt to disguise the malicious intent behind a technical facade, potentially evading casual detection by users unfamiliar with legitimate MetaMask services. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure and resolves to the IP address 216.198.79.3, associated with Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the WR1 root, providing a false sense of security. Despite its active malicious status, the domain has not yet been flagged by VirusTotal, showing 0 detections out of 95 security engines. However, it appears on three independent security blocklists, indicating prior identification by specialized threat intelligence sources. No creation date is publicly available due to the domain being a subdomain of Vercel's platform, which complicates historical tracking. Current status remains active, with confirmed blocking by at least three security entities. The remaining risk is classified as high due to the domain's operational state, low detection rate on aggregate scanning platforms, and direct targeting of cryptocurrency users. Users are advised to treat any interaction with this domain as malicious and report it to their security providers. Organizations should update their blocklists to include this domain and its associated IP address. Cryptocurrency wallet holders are reminded to verify domain authenticity before entering sensitive information and to enable multi-factor authentication where available to mitigate credential theft risks.