sui-scallop-dapp-git-codex-complete-swap-to-bd6850-scallop-team[.]vercel[.]app

PhishDestroy identifies active crypto drainer impersonating Scallop via a vercel.app-hosted domain. This campaign uses brand impersonation to trick users into connecting cryptocurrency wallets and stealing funds. Risk remains under_investigation due to zero detections on VirusTotal, but infrastructure and SSL suggest a sophisticated setup. The domain resolves to IP 216.198.79.67, registered through Vercel Inc. with a Google Trust Services SSL certificate, indicating an attempt to appear legitimate while bypassing initial scanners. No blocklist inclusions have been recorded yet, reinforcing the need for proactive monitoring.

This domain was flagged with a VirusTotal detection ratio of 1/95 engines, demonstrating how zero-day or niche-specialized phishing campaigns evade automated defenses. Creation occurred recently under Vercel's infrastructure, leveraging their trusted domain reputation to host malicious content. Trust scores remain unassessed due to lack of historical data, while the presence of a valid SSL certificate from Google Trust Services further reduces user suspicion. Without prior inclusion on blocklists such as PhishTank, OpenPhish, or Google Safe Browsing, this threat operates under the radar with minimal third-party scrutiny.

To mitigate exposure to this crypto drainer campaign, users must avoid clicking or interacting with the domain. Verify all URLs manually via official Scallop channels and use hardware wallets when interacting with decentralized applications. Report the domain to threat intelligence platforms and block the IP 216.198.79.67 at the network level. Organizations should update DNS blocklists with the exact domain and related subdomains to prevent downstream compromise. Immediate investigation of any wallet connections made during exposure is essential to assess potential asset loss.