mint-nft-box5[.]vercel[.]app

mint-nft-box5.vercel.app has been identified as a crypto drainer operation. The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the IP address 64.29.17.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site is hosted on Vercel infrastructure and serves an HSTS-enabled HTTPS endpoint with a certificate issued by Google Trust Services under the WR1 label.

A request to the root URL returns HTTP status 451, and the page title displayed is "Deployment Unavailable," indicating that the front‑end content is no longer reachable. VirusTotal analysis shows that 16 of 93 scanning engines have flagged the domain as malicious, reinforcing the suspicion of illicit activity. The domain appears on four independent security blocklists and has been explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

Although the service is currently offline, the observed indicators suggest that the domain was used to lure victims into transferring cryptocurrency to addresses controlled by the threat actors. Defenders should immediately add the domain and its resolving IP to network deny lists, monitor for any resurgence of the Vercel sub‑domain pattern, and enforce strict outbound transaction controls for cryptocurrency wallets. Continuous threat‑intel feeds should be consulted for any re‑use of the same infrastructure or similar naming conventions, as the actors may redeploy the campaign under a new subdomain once the current one is taken down.