mismatesenvp542[.]vercel[.]app

PhishDestroy identifies mismatesenvp542.vercel.app as an active generic phishing domain impersonating a cryptocurrency wallet verification portal. The domain employs no known brand or drainer kit signatures, relying instead on a generic “enter wallet seed or private key” lure to harvest credentials and drain funds. Its payload and infrastructure are deliberately minimal, suggesting a fast-turnaround campaign designed to bypass static detection layers.

This domain was flagged by 7 of 95 VirusTotal security vendors and is registered through Vercel Inc. with hosting on IP 64.29.17.131. Google Safe Browsing classifies it as SOCIAL_ENGINEERING, placing it on multiple blocklists and reducing dwell time. The absence of a clear creation date and the use of a Google Trust Services certificate underscore the threat actor’s preference for reputable-appearing certificates to lower user suspicion.

Currently the domain remains active, but PhishDestroy has issued an immediate block recommendation to all protected networks. Users encountering the domain or any sub-paths should treat it as elevated-risk and refrain from entering any private keys or seed phrases. Remaining risk factors include short-lived Vercel deployments and the potential for rapid domain hopping, so continuous monitoring and real-time threat intelligence feeds are advised to maintain protection.