aitrader-direct[.]vercel[.]app

This domain, aitrader-direct.vercel.app, is currently flagged as an active crypto phishing redirect endpoint. Analysis indicates it operates as a transient redirector, likely designed to harvest wallet credentials or distribute malicious payloads under the guise of cryptocurrency trading services. The page title 'Redirecting...' suggests automated forwarding to secondary malicious infrastructure, a common tactic in multi-stage phishing campaigns targeting decentralized finance users. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to IP address 64.29.17.131, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider often abused for malicious purposes. Security vendors on VirusTotal have flagged this domain, with 2 of 95 engines detecting it as malicious. The domain appears on three distinct security blocklists and is actively blocked by multiple wallet protection systems, including browser-based wallet extensions and transaction analysis tools. Current status remains active, with no indication of takedown or remediation. Organizations are advised to implement immediate network-level blocking of the domain and associated IP address. Endpoint protection systems should be updated to detect the redirect behavior pattern, particularly for requests originating from cryptocurrency-related applications. Users should verify all wallet connection requests manually and avoid interacting with any unsolicited trading platform links, especially those hosted on development platforms like Vercel. Network monitoring should prioritize detection of HTTP 302/307 redirect responses from this domain to identify potentially compromised endpoints.