mint-upshot[.]cards

Analysis of the domain mint-upshot.cards indicates it was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and was taken offline by July 22, 2026. The domain resolved to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data transmission. The page title, 'Layerswap I Fast, Affordable, Secure Asset Bridging & Swapping,' suggests an attempt to mimic the Layerswap cryptocurrency bridging service, though the exact content and functionality of the site remain unconfirmed due to its offline status.

Infrastructure analysis reveals the domain appeared on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, which classify it as a crypto scam. Three of 95 security vendors on VirusTotal flagged the domain at the time of scanning, reinforcing its association with malicious activity. Nameservers aldo.ns.cloudflare.com and fish.ns.cloudflare.com further link the domain to Cloudflare's infrastructure, commonly leveraged by threat actors to obscure origins and evade takedowns. The unique seed '628e32' and the classification as a 'crypto drainer' in available threat intelligence indicate the site likely targeted cryptocurrency users by draining wallet funds through deceptive transactions.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Given its offline status, further forensic analysis is limited, but historical records and detection counts provide sufficient evidence to classify mint-upshot.cards as a confirmed crypto scam domain. Organizations are advised to monitor for related infrastructure, such as similarly named domains or shared hosting IPs, to preemptively mitigate emerging threats.