cptn[.]vercel[.]app

The domain cptn.vercel.app is currently active and engaged in brand impersonation targeting Phantom, a cryptocurrency wallet service. Analysis indicates this is a high-risk crypto drainer operation designed to deceive users into connecting their wallets to malicious smart contracts, resulting in unauthorized fund transfers. The domain remains operational as of the latest verification. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. and resolves to the IP address 64.29.17.3, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain was created on February 21, 2026, though this date may reflect registry manipulation or a typographical error in available records. Security telemetry shows 1 of 95 VirusTotal vendors flagging the domain, while it appears on 2 independent security blocklists, including PhishDestroy and Enkrypt. The SSL certificate is issued by Google Trust Services (WR1), providing a superficial layer of legitimacy. The page title, 'DeCaptain App,' attempts to mimic legitimate crypto service branding while concealing its true purpose. Current status confirms the domain remains active and accessible. Users are advised to treat this domain as hostile and avoid interaction. Security teams should immediately block the domain and associated IP at the network perimeter. Wallet providers should issue warnings to users about this impersonation campaign and monitor for transaction anomalies linked to this infrastructure. Cryptocurrency exchanges and wallet services should flag any addresses associated with this domain for enhanced scrutiny. Given the high-risk nature of crypto drainers, affected users should revoke any connected wallet permissions and transfer assets to a new secure wallet.