mint-nft-box10[.]vercel[.]app

This domain is flagged as a high-risk instance of brand impersonation, specifically targeting users with a fraudulent NFT mint scam. The threat leverages deceptive infrastructure to mimic legitimate NFT minting platforms, tricking victims into connecting wallets or disclosing sensitive credentials under false pretenses. Analysis indicates the domain is actively exploited in ongoing campaigns, posing significant financial and operational risks to individuals and organizations involved in digital asset transactions. Infrastructure analysis reveals the domain mint-nft-box10.vercel.app resolves to the IP address 64.29.17.67, hosted on infrastructure operated by Amazon.com, Inc. (AS16509) within the United States. The domain was registered on February 21, 2026, through Tucows Domains Inc., a registrar commonly utilized in both legitimate and malicious operations. Detection metrics from security vendors indicate 16 out of 95 engines on VirusTotal have flagged the domain as malicious, while it appears on five distinct security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. The SSL certificate is issued by Google Trust Services under the WR1 intermediate, a common practice among threat actors to lend superficial legitimacy to their operations. The page currently displays a 'Deployment Unavailable' status, a tactic often employed to evade automated detection while maintaining operational readiness for targeted attacks. Mitigation against this threat requires a multi-layered approach tailored to the specific risks posed by NFT mint scams. Network-level protections should include the immediate blocking of the domain mint-nft-box10.vercel.app and its associated IP address 64.29.17.67 across all security gateways and endpoint protection systems. Organizations and individuals involved in digital asset transactions should enforce strict validation protocols for NFT minting events, including cross-referencing official project announcements with on-chain data and verifying smart contract addresses through trusted sources. Wallet security measures must be reinforced, such as disabling automatic transaction approvals and implementing hardware-based authentication for high-value interactions. Continuous monitoring of domain registrations under similar naming conventions (e.g., 'mint-nft-box', 'vercel.app') is recommended to preemptively identify and neutralize related threats.