cryptoapp-puce[.]vercel[.]app

This domain, cryptoapp-puce.vercel.app, is classified as a high-risk cryptocurrency credential phishing threat. Analysis indicates the infrastructure was designed to mimic legitimate wallet or exchange platforms, tricking users into submitting private keys, recovery phrases, or login credentials. The threat type aligns with generic_phishing but exhibits specialization in cryptocurrency assets, increasing potential financial impact for targeted victims.

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 64.29.17.67 (US, AS16509 Amazon.com, Inc.), though it is currently offline. It was registered through Tucows Domains Inc. on February 21, 2026, an anomalous future date suggesting domain spoofing or registry manipulation. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to appear legitimate. Detection metrics include 12/95 security vendor flags on VirusTotal, a Google Safe Browsing phishing classification, and presence on one security blocklist (PhishDestroy). The page title "Deployment Unavailable" may indicate a placeholder or takedown state, though prior content likely included functional phishing kits.

Mitigation requires immediate action from security teams and end users. Network administrators should block the domain and associated IP at perimeter defenses, while monitoring for related subdomains or newly registered lookalike domains. Cryptocurrency users should verify all wallet interactions via official channels only, avoiding links from emails, social media, or search results. Organizations should implement multi-factor authentication for internal systems to reduce credential theft risk. Given the domain's cryptocurrency focus, wallet providers and exchanges should proactively warn users about this specific threat vector and provide guidance on verifying legitimate interfaces.