eastore-filecoin[.]vercel[.]app

The domain eastore-filecoin.vercel.app was registered on September 14 2025 through Vercel Inc. and is hosted on the Vercel platform, which automatically provides HTTPS via a Google Trust Services certificate (WR1) and enforces HTTP Strict Transport Security. The site resolves to the IP address 64.29.17.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States.

Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category, and three independent blocklists – PhishDestroy, MetaMask, and SEAL – have already added the domain to their denial lists. VirusTotal scans show that 12 out of 95 security vendors flag the domain as malicious, while the Gridinsoft trust score is 0 out of 100, indicating a highly suspicious reputation. HTTP requests return a 200 status code, confirming that the site is actively serving content.

The campaign targets users of the MetaMask wallet by impersonating the brand, as indicated by the threat type 'brand_impersonation' and the explicit brand target MetaMask. The page title returned by the server is 'Eastore', which does not correspond to the legitimate MetaMask branding, suggesting the page is being used to lure victims into a cryptocurrency‑related scam. The scam type is explicitly listed as cryptocurrency, and the infrastructure remains active as of the report date.

Defenders should block traffic to eastore-filecoin.vercel.app at network perimeters and include the associated IP 64.29.17.195 in deny lists. Monitoring for DNS queries to the domain and for outbound connections to the identified IP can help detect compromised clients. Because the actual page content has not been publicly analysed, further investigation of the payload and any credential‑stealing mechanisms is recommended to fully characterize the threat vector.