safelock-web[.]vercel[.]app

This domain, safelock-web.vercel.app, is flagged as a high-risk crypto wallet phishing resource targeting users through credential harvesting and wallet-draining mechanisms. The page title, "Safelock," suggests an attempt to impersonate legitimate cryptocurrency security services, likely exploiting user trust in wallet protection tools. No explicit drainer kit signatures have been confirmed, but the domain exhibits behavioral patterns consistent with wallet-focused phishing campaigns, including simulated transaction prompts and seed phrase collection forms. Infrastructure analysis reveals the domain resolves to IP address 64.29.17.131, hosted on infrastructure belonging to AS16509 (Amazon.com, Inc.) in the United States. The domain was registered through Vercel Inc. on March 13, 2026, an unusually forward-dated creation timestamp that may indicate automated or bulk registration practices. Detection metrics show 1 of 95 security vendors on VirusTotal flagging the domain, while three independent blocklists—PhishDestroy, MetaMask, and SEAL—have classified it as malicious. The SSL certificate is issued by Google Trust Services (WR1), providing HTTPS encryption that enhances the appearance of legitimacy. As of the latest verification, safelock-web.vercel.app remains active and accessible. No takedown actions have been observed, and the domain continues to resolve without interruption. The low detection rate on aggregate scanning platforms suggests either evasion techniques or recent deployment, reducing visibility among automated security tools. Users are advised to block the domain at the network level, avoid interaction with any linked resources, and verify wallet addresses through trusted channels. Organizations should update internal blocklists with the domain and associated IP to mitigate exposure.