premium0peanseamint4[.]vercel[.]app

This domain, premium0peanseamint4.vercel.app, operates as an active crypto drainer phishing infrastructure designed to illicitly extract cryptocurrency from compromised digital wallets. The threat specifically targets users through deceptive interfaces mimicking legitimate wallet or token approval prompts, tricking victims into authorizing transactions that transfer assets to attacker-controlled addresses. Analysis indicates the domain is engineered to exploit trust in decentralized finance (DeFi) platforms, leveraging social engineering tactics to bypass security measures in browser-based wallets. Infrastructure analysis reveals the domain resolves to the IP address 64.29.17.195, hosted under Vercel Inc., with an SSL certificate issued by Google Trust Services (WR1). The domain currently appears on three security blocklists, and VirusTotal reports detection by 7 out of 95 security vendors, confirming its malicious classification. The page title, 'Deployment Unavailable,' suggests an attempt to obfuscate its true purpose, potentially indicating a placeholder or fallback state for the phishing kit. The unique seed identifier ed3751 may correlate with specific campaign configurations or tracking mechanisms used by the threat actors. Users who have interacted with premium0peanseamint4.vercel.app should immediately revoke any suspicious wallet approvals or token allowances granted during the encounter. It is critical to disconnect the wallet from all connected decentralized applications (dApps) and transfer remaining assets to a new, secure wallet address. Victims should also monitor their transaction history for unauthorized transfers and report the incident to relevant blockchain security platforms for further analysis. Given the high-risk classification, any credentials or private keys exposed to this domain should be considered compromised and discarded.