xtfi231[.]vercel[.]app

This domain, xtfi231.vercel.app, is flagged as a high-risk cryptocurrency wallet phishing site targeting users through deceptive interfaces mimicking legitimate wallet services. Analysis indicates the presence of credential harvesting mechanisms, likely part of a broader drainer kit operation designed to exfiltrate private keys or recovery phrases. No specific brand impersonation has been confirmed, but the domain structure and content suggest generic wallet-themed phishing targeting multiple cryptocurrency platforms. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure, resolving to IP address 216.198.79.67 within Amazon.com, Inc. (AS16509) in the United States. The domain is detected by 20 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it as phishing. It appears on one additional security blocklist and is currently blocked by enterprise phishing detection systems. The SSL certificate is issued by Google Trust Services (WR1), providing HTTPS encryption that may lend false legitimacy to the phishing attempt. No creation date is available, but the domain remains actively resolving. Current status shows the phishing infrastructure remains operational, posing ongoing risk to cryptocurrency users. Response actions should include immediate blocking of the domain and IP address across security controls, along with monitoring for related domains using similar naming patterns or Vercel hosting. Users who interacted with this domain should revoke any connected wallet sessions, rotate credentials, and scan for unauthorized transactions. The high-risk assessment remains valid due to active hosting, HTTPS encryption, and confirmed phishing detections across multiple security platforms. Network defenders should prioritize this domain for blacklisting in web gateways and endpoint protection systems.