mint-nft-box4[.]vercel[.]app

The domain mint-nft-box4.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and resolved to the Amazon‑owned IP address 64.29.17.195, located in the United States under ASN 16509. The site presented the page title "Deployment Unavailable" and returned HTTP status code 451, indicating that the content was removed for legal reasons. TLS negotiation succeeded using a certificate issued by Google Trust Services (WR1), and the server advertised HTTP Strict Transport Security (HSTS). Vercel infrastructure was detected, confirming the use of the Vercel hosting platform.

Security telemetry shows the domain is listed on four blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and appears on four additional security blocklists. VirusTotal scanned the domain and 15 of 93 antivirus engines flagged it as malicious, consistent with its classification as a crypto‑drainer scam. The combination of a recent registration, Amazon hosting, Vercel deployment, and the presence on multiple blocklists suggests an active threat actor targeting cryptocurrency users. Current evidence does not disclose the exact payload or phishing page content, and the site is presently offline, limiting further behavioural analysis.

Defenders should immediately block the domain and its associated IP address at perimeter and endpoint controls, monitor DNS logs for any resolution attempts, and correlate internal traffic with the 64.29.17.195 endpoint. Continuous observation of newly created Vercel subdomains linked to the same registrar is advised, as threat actors often rotate similar URLs. Updating URL filtering and threat intelligence feeds with the observed indicators will reduce exposure to this crypto drainer campaign.