projectlicks-box08[.]vercel[.]app

Domain projectlicks-box08.vercel.app has been flagged as an active crypto drainer phishing site. This threat involves a fraudulent setup designed to trick cryptocurrency users into connecting their wallets, leading to unauthorized fund transfers. The domain mimics legitimate service interfaces to deceive visitors into entering sensitive wallet credentials or authorizing malicious transactions. Initial analysis reveals classic phishing tactics, including spoofed UI elements and social engineering prompts to extract private keys or transaction approvals. The infrastructure leverages Vercel’s hosting platform, which introduces a layer of legitimacy through reputable SSL certificates issued by Google Trust Services. With zero detections on VirusTotal and no immediate blocklist presence, this domain remains highly evasive, targeting users through unsuspecting channels such as social media or phishing emails. Technical evaluation shows this domain was registered through Vercel Inc., resolving to IP 64.29.17.3. Current threat intelligence reports 12/95 VirusTotal detections, indicating no antivirus or security vendor has flagged it despite its malicious nature. The domain’s recent registration and clean reputation score on major threat feeds suggest a deliberate, targeted campaign likely still in its active phase. Additional risk factors include its use of a Google-issued SSL certificate, which may bypass browser warnings for some users. While the hosting provider and certificate add superficial credibility, the domain’s purpose aligns with known crypto drainer infrastructure, where attackers prioritize short-lived, high-impact operations to maximize illicit gains before detection. Users who have visited projectlicks-box08.vercel.app should immediately revoke any wallet connections or approvals granted to the site using tools like Revoke.cash or their wallet’s built-in revoke feature. Disconnect the domain from all associated accounts and scan for unauthorized transactions in wallet histories. Enable multi-factor authentication where possible and avoid re-engaging with similar links. Report the domain to PhishDestroy for further analysis to strengthen collective threat intelligence. Stay vigilant for follow-up phishing attempts, as compromised users may become targets for secondary scams.