mint-nftboxx04[.]vercel[.]app

Analysis indicates that the domain mint-nftboxx04.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is currently taken offline, returning HTTP status 451 with the page title “Deployment Unavailable.” The host resolves to IP address 64.29.17.195, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. TLS termination is provided by a Google Trust Services certificate issued to “WR1,” and the server presents HTTP Strict Transport Security (HSTS) headers, confirming the use of modern security controls typical of the Vercel platform. Multiple security‑centric sources have flagged the domain.

Four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—include the domain, and VirusTotal reports that 11 of 95 scanning engines label the site as malicious. The classification supplied in the intelligence set identifies the activity as a “Crypto Scam” and more specifically a “crypto drainer,” suggesting that the infrastructure was intended to lure victims into transferring cryptocurrency to attacker‑controlled wallets. Defenders should note that the domain’s hosting on Vercel does not inherently imply malicious intent, but the convergence of blocklist listings, VirusTotal detections, and the explicit crypto‑drainer label warrants proactive mitigation.

Recommended actions include adding the domain to local deny lists, updating web‑gateway and DNS filtering policies to block resolution of 64.29.17.195, and monitoring for any future re‑registration attempts under similar sub‑domains. Because the site is presently offline, ongoing observation is advised to capture any re‑appearance or reuse of the same IP block. The evidence presented—registration data, hosting details, TLS certificate, blocklist presence, and VirusTotal findings—provides a concrete basis for elevating the threat posture of this infrastructure to high and implementing defensive controls accordingly.