paytm-wallet-user-app[.]vercel[.]app

This domain, paytm-wallet-user-app.vercel.app, is assessed as a high-risk crypto_drainer. The threat involves unauthorized access to users' cryptocurrency wallets, potentially leading to significant financial losses.

Analysis indicates that this domain was registered through Tucows Domains Inc. on February 24, 2026. It resolves to the IP address 64.29.17.67, which is located in the United States and is part of the AS16509 network, operated by Amazon.com, Inc. The domain is currently active and has been flagged by 21 out of 95 security vendors on VirusTotal, indicating a notable level of suspicion. The SSL certificate is issued by Google Trust Services, providing an additional layer of trust that may be exploited to gain user confidence. The domain appears on one security blocklist, specifically PhishDestroy, further confirming its malicious nature. The creation date and registration through a reputable registrar suggest a recent and potentially targeted campaign. The low trust score and active status indicate that this domain is actively being used for malicious purposes.

To mitigate the risks associated with this crypto_drainer, users should avoid clicking on any links or entering sensitive information on paytm-wallet-user-app.vercel.app. It is recommended to verify the authenticity of any Paytm-related communications through official channels and to use multi-factor authentication for all cryptocurrency wallets. Network administrators should consider blocking this domain at the firewall level to prevent access from within their networks. Additionally, users should ensure their devices are running up-to-date antivirus and anti-malware software to detect and prevent any related malicious activities.