premium0peanseamint8[.]vercel[.]app

PhishDestroy identifies premium0peanseamint8.vercel.app as an active crypto drainer domain operating under an elevated risk classification. This fraudulent site is designed to intercept and drain cryptocurrency assets from unwitting users by impersonating legitimate services through deceptive branding. The threat actor leverages a crypto-drainer kit, a malicious JavaScript payload that automates unauthorized wallet connections and token transfers upon user interaction, particularly targeting wallets connected via Web3 interfaces. The domain’s infrastructure suggests a focus on evasion, utilizing legitimate cloud hosting and SSL certificates to appear credible while executing its illicit operations. This domain resolves to IP address 64.29.17.67 and is registered through Vercel Inc., a legitimate cloud platform provider that has been abused to host malicious content. According to VirusTotal intelligence, the domain has a detection ratio of 6/95 security vendors, indicating partial recognition of its malicious nature but not universal blocking. Google Safe Browsing (GSB) has flagged this domain, and it appears on one additional security blocklist. MetaMask, a popular cryptocurrency wallet, has proactively blocked this domain, preventing users from accidental exposure. The domain also holds an SSL certificate issued by Google Trust Services, which adds a veneer of legitimacy but does little to mitigate the underlying threat. While the exact registration date is not publicly disclosed, the combination of these indicators paints a clear picture of a recently active, evasive threat actor. Currently, premium0peanseamint8.vercel.app remains active and poses an elevated risk to users who may encounter it through phishing emails, social media links, or fraudulent advertisements. Immediate action has been taken by security vendors and wallet providers to block or flag the domain, reducing but not eliminating exposure. However, the threat actor may continue to adapt by registering new subdomains or domains under Vercel’s infrastructure. Users are strongly advised to verify any suspicious URLs using PhishDestroy’s real-time threat intelligence platform before interacting with unknown websites or connecting cryptocurrency wallets. Remaining vigilant and cross-referencing domains against trusted blocklists remains critical in preventing financial loss from crypto drainer scams.