drain-tokens[.]vercel[.]app

The domain drain-tokens.vercel.app is currently active and hosts a web page titled “Drain”. The site was registered on 21 February 2026 through Tucows Domains Inc. and resolves to the IP address 216.198.79.131, an infrastructure owned by Vercel, Inc. in the United States. TLS is provided by Google Trust Services (WR1) and the server presents HTTP Strict Transport Security headers. Reputation services rate the host poorly: Gridinsoft assigns a score of 0 / 100, and the domain appears on a single security blocklist, specifically PhishDestroy. VirusTotal analysis shows that two of ninety‑three scanned scanners flagged the domain, indicating a minimal but non‑zero detection rate. The observed characteristics—cryptocurrency‑related naming, “Drain” page title, and the classification as a “Crypto Scam”—suggest the site is being used to lure victims into transferring digital assets. At present, no additional payload or phishing page content has been publicly disclosed, leaving the exact victim‑interaction flow uncertain. Defenders should consider adding the domain and its resolved IP to deny‑list rules, monitor DNS queries for the domain, and employ sinkholing where feasible. Continuous re‑evaluation is advised, as the threat actor may adapt the page or expand infrastructure.