vercel3266cbda4916e9a3[.]vercel[.]app

This domain, vercel3266cbda4916e9a3.vercel.app, is flagged as a high-risk generic phishing threat designed to harvest cryptocurrency wallet credentials. Analysis indicates the domain mimics legitimate wallet login interfaces, likely employing a credential drainer kit to capture user inputs such as private keys, seed phrases, or authentication tokens. The infrastructure shows no direct affiliation with known brands, but the phishing pages are structured to resemble common crypto wallet services, increasing the likelihood of successful social engineering attacks against unsuspecting users. Technical indicators confirm the domain's malicious intent. It resolves to IP address 64.29.17.195, hosted under Vercel, Inc. in the United States. The domain was registered on April 18, 2026, through Vercel's platform. As of the latest scan, 17 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain appears on one security blocklist and is currently blocked by at least one anti-phishing service. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the domain's malicious use. Google Safe Browsing (GSB) status remains unconfirmed but is likely to classify it as unsafe given the detection rate. The domain remains active, posing an ongoing risk to users who may encounter it through phishing campaigns, malicious advertisements, or compromised websites. Response actions should include immediate blacklisting of the domain and IP address in enterprise security systems, as well as monitoring for related infrastructure under the same registrar. Users are advised to verify domain authenticity before entering sensitive information, particularly in the context of cryptocurrency transactions. Given the domain's recent creation and high detection rate, it is likely part of a broader phishing operation, and further related domains may emerge under similar naming conventions or hosting providers.