vellum[.]fund

This domain, vellum.fund, is flagged as a high-risk crypto drainer phishing site designed to compromise cryptocurrency wallets and siphon digital assets. Analysis indicates the domain targets users through deceptive interfaces mimicking legitimate financial or DeFi platforms, tricking victims into authorizing malicious transactions that drain funds from connected wallets. The threat type is highly specific: crypto drainers exploit smart contract interactions to execute unauthorized transfers, often bypassing traditional security measures like two-factor authentication. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with malicious activity. It resolves to the IP address 45.129.141.158, which has been linked to other phishing campaigns. Security vendor detections on VirusTotal report 13/95 flags, while the domain appears on three independent blocklists, including MetaMask and PhishDestroy. The Gridinsoft trust score is 0/100, and AlienVault OTX lists it in at least one threat intelligence pulse. The SSL certificate, issued by Let's Encrypt, provides minimal assurance, as it is commonly used by both legitimate and malicious domains to encrypt traffic. Mitigation requires immediate action from both users and network defenders. Users who interacted with vellum.fund should revoke all active wallet authorizations via blockchain explorers or dedicated revocation tools, then transfer remaining assets to a new, secure wallet. Network-level protections should include blocking the domain and its resolving IP (45.129.141.158) at firewalls and DNS resolvers. Organizations should monitor for connections to this IP or domain in proxy logs and endpoint telemetry. Security teams are advised to correlate this indicator with other crypto drainer campaigns, particularly those using similar registrar patterns or IP ranges. Wallet providers and DeFi platforms should proactively warn users about this domain and implement transaction simulation tools to detect and block drainer interactions in real time.