run-cache[.]vercel[.]app

This domain is flagged as an active phishing site designed to harvest cryptocurrency wallet credentials, including private keys and seed phrases. Analysis indicates the site mimics legitimate wallet interfaces to deceive users into entering sensitive authentication details, which are then transmitted to attacker-controlled infrastructure. The threat primarily targets users of decentralized finance (DeFi) platforms and non-custodial wallets, where credential compromise leads to immediate and irreversible asset theft. Infrastructure analysis reveals the domain is registered through Vercel Inc. and currently resolves to IP address 216.198.79.195, hosted on Amazon.com, Inc. (AS16509) in the United States. Despite remaining undetected by VirusTotal (0/95 security engines), the domain appears on three independent security blocklists, including PhishDestroy and SEAL. The SSL certificate, issued by Google Trust Services (WR1), provides HTTPS encryption, which attackers leverage to create a false sense of legitimacy. The domain's registration details and hosting provider align with common phishing infrastructure patterns observed in recent credential-harvesting campaigns. Users who have visited run-cache.vercel.app should immediately revoke any wallet permissions granted to unknown applications and transfer assets to a new, secure wallet. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. If credentials were entered, assume full compromise and cease using the affected wallet. Report the incident to relevant blockchain security teams and local cybersecurity authorities. Future interactions with the domain should be avoided, and network-level blocking of 216.198.79.195 is recommended for organizations.