departamentodeguiassconsultassc[.]vercel[.]app

PhishDestroy identifies departamentodeguiassc.vercel.app as an active crypto drainer phishing domain designed to trick users into connecting cryptocurrency wallets under the guise of a Brazilian tax authority portal. The attacker leverages a Vercel-hosted subdomain to deploy a spoofed login interface that exfiltrates private keys and seed phrases, redirecting stolen funds to attacker-controlled wallets. This threat is classified as elevated due to its targeting of crypto investors and use of a legitimate cloud platform to evade traditional network defenses. This domain was flagged by PhishDestroy with a VirusTotal detection ratio of 1 out of 95 security vendors, indicating low but meaningful coverage across antivirus engines. The domain is registered through Vercel Inc., a legitimate cloud hosting provider, and resolves to the IP address 216.198.79.131. The SSL certificate issued by Google Trust Services lends superficial credibility, masking the malicious intent behind an official-looking subdomain structure. If you visited this domain, disconnect your wallet immediately and revoke any unauthorized permissions via your wallet’s connected app settings. Do not interact with prompts requesting private keys, seed phrases, or wallet connections. Report the incident to PhishDestroy and your wallet provider using the unique seed identifier 1a66a6 to aid in takedown efforts. Enable transaction alerts and consider using hardware wallets for enhanced security against future crypto drainer attacks.