wallet-landing-near[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat targeting cryptocurrency users. Analysis indicates the site mimics Ethereum wallet interfaces to deceive victims into disclosing sensitive credentials or authorizing fraudulent transactions, a tactic commonly associated with crypto drainers. The domain operates under the guise of a legitimate service, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure, resolving to IP address 64.29.17.131 within Amazon.com, Inc.'s AS16509 (United States). The SSL certificate is issued by Google Trust Services (WR1), a common practice among threat actors to lend false legitimacy. The domain appears on two security blocklists and is flagged by 21 out of 95 security vendors on VirusTotal, with additional detections from Google Safe Browsing and specialized phishing databases such as PhishDestroy and PhishingDB. The page title, 'NEAR Wallet,' further confirms the intent to impersonate a legitimate cryptocurrency wallet service, despite targeting Ethereum users. Mitigation steps for this threat type include immediate blacklisting of the domain and its associated IP address across all security gateways and endpoint protection systems. Network administrators should implement DNS sinkholing for the domain to prevent resolution within corporate or institutional environments. Users should be educated to verify wallet URLs directly through official sources and avoid interacting with unsolicited links, particularly those received via email or social media. Cryptocurrency holders are advised to revoke any suspicious wallet authorizations and monitor transaction histories for unauthorized activity. Given the active status of this domain, continuous monitoring for related infrastructure or similar impersonation attempts is recommended.