run-simulator[.]vercel[.]app

This domain, run-simulator.vercel.app, has been flagged as a crypto wallet phishing endpoint targeting users through simulated decentralized application interfaces. Analysis indicates the site mimics legitimate wallet connection prompts to harvest private keys and seed phrases, a technique commonly associated with drainer kits such as Angel Drainer or Inferno Drainer. No specific brand impersonation has been confirmed, but the domain name suggests an attempt to deceive users into believing they are interacting with a blockchain-based simulation or gaming platform. Infrastructure analysis reveals the domain resolves to the IP address 64.29.17.195, with no detections reported across 95 security engines on VirusTotal (0/95). The domain is registered through Vercel Inc., a platform commonly used for hosting both legitimate and malicious content due to its free tier and ease of deployment. No creation date is publicly available, and the domain remains unlisted on Google Safe Browsing (GSB) or any known blocklists. The absence of detections does not indicate benign behavior but rather a lack of prior reporting or evasion of automated detection mechanisms. As of the latest assessment, run-simulator.vercel.app remains active and under investigation, with no takedown or sinkholing actions observed. The domain poses a high residual risk due to its operational status and the potential for credential harvesting. Network defenders are advised to block the domain and its resolving IP at the perimeter, while endpoint protection solutions should be updated to flag the domain as malicious. Users who may have interacted with the site should revoke any connected wallet permissions and monitor for unauthorized transactions. Further analysis is required to determine the full scope of the campaign and any associated infrastructure.