wallet-kage[.]vercel[.]app

This domain, wallet-kage.vercel.app, is actively impersonating Ethereum wallet infrastructure to deploy crypto drainer scripts. Analysis indicates the site presents a fraudulent interface mimicking legitimate Ethereum wallet services, designed to trick users into connecting their wallets. Once connected, the site executes unauthorized transactions, draining cryptocurrency assets from victims' wallets without consent. The threat specifically targets users familiar with decentralized finance (DeFi) platforms, leveraging social engineering tactics to bypass security awareness.

Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc., an unusual registration date suggesting potential domain spoofing or backdating. As of the latest scan, the domain has 0/95 detections on VirusTotal, indicating it has not yet been widely flagged by security vendors. However, it appears on 4 security blocklists, including entries from PhishDestroy, Polkadot, Enkrypt, and Codeesura. The domain resolves to IP address 64.29.17.131, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States, and uses an SSL certificate issued by Google Trust Services (WR1).

Users who have visited wallet-kage.vercel.app or connected their wallets to the site should immediately revoke any active wallet connections via their wallet settings. It is recommended to transfer remaining assets to a new, secure wallet address and monitor transaction history for unauthorized activity. If funds have been lost, report the incident to relevant blockchain explorers and law enforcement agencies with transaction hashes and timestamps. Additionally, clear browser cache and stored credentials to prevent further interaction with the malicious domain.