minting-box21[.]vercel[.]app

minting-box21.vercel.app was observed hosting a crypto‑drainer campaign. The domain was created on 21 February 2026 and is registered through Tucows Domains Inc. DNS resolution points to IP 64.29.17.67, an address belonging to Amazon.com, Inc. (AS16509) located in the United States. The site served an HTTP 451 response and presented the page title “Deployment Unavailable”, indicating that the Vercel deployment has been taken offline. The TLS certificate is issued by Google Trust Services under the WR1 intermediate, confirming that transport encryption was correctly established while the site was active. Threat intelligence feeds have listed the domain on four security blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura.

VirusTotal scans returned 15 positive detections out of 93 submitted security vendors, reinforcing the malicious classification. Automated analysis identified the hosting platform as Vercel and observed the presence of HTTP Strict Transport Security (HSTS) headers, a common configuration for legitimate Vercel sites but also adopted by malicious actors to increase credibility. The available evidence classifies the campaign as a crypto scam, consistent with the “crypto drainer” label supplied. No additional content such as login forms or brand impersonation was captured; the page title is the only visible artifact. Consequently, the precise tactics employed by the operators remain uncertain, including whether the site previously delivered malicious smart‑contract interactions or phishing pages.

Defenders should continue to block the domain at network perimeter and DNS layers, given its presence on multiple blocklists and the positive VirusTotal detections. Monitoring of the associated IP address 64.29.17.67 is advised, as the host may be reused for future malicious deployments.