vy6w6itqm8-2996498a9e[.]vercel[.]app

PhishDestroy identifies vy6w6itqm8-2996498a9e.vercel.app as an active crypto drainer designed to steal cryptocurrency wallet credentials. This domain poses an elevated risk by luring victims into connecting their wallets, which then silently siphons funds to attacker-controlled addresses. Security researchers have observed similar campaigns where phishing pages mimic legitimate DeFi platforms, NFT minting sites, or wallet connection interfaces to trick users into approving malicious transactions via wallet signatures. The domain’s structure—using a subdomain of vercel.app—is a common tactic to appear legitimate while hosting malicious content.

This domain was flagged by PhishDestroy after security vendors detected suspicious behavior. VirusTotal reports 7 out of 95 security engines flagged this domain as malicious, indicating a high likelihood of harmful activity. The domain resolves to IP address 64.29.17.131 and uses an SSL certificate issued by Google Trust Services, which attackers often exploit to appear trustworthy. Registered via Vercel Inc., a legitimate cloud platform, the domain’s creation date and hosting provider are intentionally obscured to evade detection. The combination of a generic subdomain, recent registration, and high VirusTotal detection rate strongly suggests this is part of a coordinated phishing campaign targeting crypto users.

If you visited vy6w6itqm8-2996498a9e.vercel.app, immediately disconnect your wallet and revoke any approved permissions through your wallet’s settings or a reputable tool like Revoke.cash. Do not approve any additional transaction requests or sign messages from this domain. Scan your device for malware using a trusted antivirus, as crypto drainers often bundle keyloggers or clipboard hijackers. Report the domain to PhishDestroy and your local cybersecurity authorities to help block future attacks. Always verify URLs before interacting, especially those shared in unsolicited messages or social media posts.