listed-livegrabs35[.]vercel[.]app

This domain, listed-livegrabs35.vercel.app, is flagged as a Web3 wallet drainer phishing site targeting cryptocurrency users. Analysis indicates the infrastructure is designed to impersonate legitimate wallet interfaces, likely deploying malicious JavaScript to siphon funds upon connection. No specific brand impersonation is confirmed, but the naming convention and hosting pattern align with known wallet-drainer kits observed in prior campaigns. The page title 'Deployment Unavailable' suggests either a placeholder or deliberate obfuscation to evade detection during initial scans. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, an anomalous future date indicating potential registrar data manipulation or spoofing. It resolves to IP address 64.29.17.3, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend legitimacy. Detection metrics show 16 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on five independent security blocklists. Google Safe Browsing status remains unconfirmed but is likely flagged given the blocklist prevalence. The domain remains active as of analysis, with no takedown or sinkholing observed. Response actions by security providers include blocking by at least five known threat intelligence feeds, though gaps in coverage may persist due to the domain's recent registration anomaly. The remaining risk is classified as high due to the active status, cryptocurrency-targeting nature, and use of obfuscation techniques. Users are advised to verify wallet addresses via official channels, avoid connecting wallets to unverified sites, and cross-reference domain creation dates for anomalies. Network-level blocking of the IP and domain is recommended for enterprise environments.