mystery-box-ivory[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat specifically targeting Ethereum users. Analysis indicates the infrastructure is designed to deceive victims into believing they are interacting with the legitimate OpenSea.io platform, a known Ethereum-based NFT marketplace. The page title explicitly displays 'OpenSea.io,' reinforcing the fraudulent intent to mislead users into disclosing wallet credentials or transferring assets to attacker-controlled addresses. Infrastructure analysis reveals the domain mystery-box-ivory.vercel.app is registered through Vercel Inc. and resolves to the IP address 216.198.79.131, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Security vendors on VirusTotal flag the domain in 22 out of 95 scans, while it appears on two independent security blocklists. The domain remains active as of this report, and its SSL certificate is issued by Google Trust Services (WR1), providing a false sense of legitimacy. No historical registration data or creation date is available, suggesting potential use of ephemeral hosting services to evade detection. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address across all network security controls. Users should be advised to verify the authenticity of any Ethereum-related platform by cross-referencing official domains and checking for SSL certificate transparency logs. Organizations should monitor for credential submission attempts to this domain and deploy browser-based warnings for employees or customers accessing known impersonation sites. Given the high-risk nature of cryptocurrency-related fraud, real-time threat intelligence feeds should be updated to include this domain and its indicators of compromise.