dappwalletcheck[.]vercel[.]app

This domain, dappwalletcheck.vercel.app, is identified as a crypto drainer phishing site designed to compromise digital wallet connections. Analysis indicates the site employs malicious JavaScript to intercept and drain cryptocurrency assets from unsuspecting users, a common tactic in decentralized application (dApp) fraud schemes. The page title, 'Dappwallet Check,' suggests an attempt to impersonate legitimate wallet verification services, though no direct brand impersonation is confirmed. The infrastructure aligns with known drainer kits, which exploit vulnerabilities in wallet connection protocols to execute unauthorized transactions. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 64.29.17.195, hosted on Amazon.com, Inc. (AS16509) in the United States. It was registered on March 01, 2026, through Vercel Inc., and is secured with an SSL certificate issued by Google Trust Services (WR1). The domain is flagged by 21 out of 95 security vendors on VirusTotal and appears on four independent security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The creation date is anomalous, predating the current year, which may indicate domain spoofing or an error in registration records. No Google Safe Browsing (GSB) status is provided, but the high detection rate underscores its malicious nature. The domain is currently offline, likely due to takedown actions by the hosting provider or security entities. However, residual risk remains as the infrastructure may be repurposed or mirrored under a different domain. Users who interacted with this site should immediately revoke any connected wallet permissions, audit transaction histories for unauthorized activity, and monitor for further phishing attempts. Organizations should update blocklists to include this domain and its associated IP address to prevent future access. The combination of high vendor detections, blocklist inclusions, and anomalous registration details confirms this as a high-risk crypto drainer operation.