projectlicks-box06[.]vercel[.]app

PhishDestroy identifies projectlicks-box06.vercel.app as a recently activated crypto drainer campaign leveraging a Vercel-hosted phishing page. This domain, registered through Vercel Inc. and secured with a Google Trust Services SSL certificate, resolves to IP 64.29.17.131. The page impersonates legitimate cryptocurrency wallet login interfaces to trick users into connecting their wallets for fund extraction. Security telemetry shows zero detections on VirusTotal out of 95 engines, indicating this threat has evaded initial detection layers. Additionally, the domain has not been added to any public blocklists, presenting a clear risk to unsuspecting users. The domain’s infrastructure raises several red flags. Registered through Vercel, a legitimate cloud platform, it blends into normal web traffic while hosting malicious content. Its SSL certificate, issued by Google Trust Services, lends false legitimacy, potentially bypassing browser warnings. The IP address 64.29.17.131, shared across multiple Vercel deployments, shows no direct malicious history but aligns with patterns observed in fast-flux hosting used by phishing campaigns. The absence of detections on VirusTotal suggests either a zero-day deployment or deliberate evasion tactics, such as delayed payload activation or cloaking based on visitor attributes. Users who visited this domain should immediately disconnect their cryptocurrency wallets and revoke any connected permissions. If transactions were authorized, monitor accounts for unauthorized transfers and report to relevant blockchain explorers or law enforcement. Clear browser cache and cookies, and avoid interacting with similar domains. Organizations should block projectlicks-box06.vercel.app and the associated IP at the network perimeter. Report the domain to PhishDestroy for further analysis and inclusion in threat feeds. Proactive monitoring of wallet connection requests is strongly advised to prevent financial loss.