mintingnow-opnsea38[.]vercel[.]app

mintingnow-opnsea38.vercel.app is currently listed as an offline crypto‑drainer site. The domain was registered on 21 February 2026 through Tucows Domains Inc. and is served via Vercel’s platform, as indicated by the “vercel.app” suffix and the presence of Vercel and HSTS in the technology fingerprint. The TLS certificate is issued by Google Trust Services under the WR1 label, confirming the use of Google’s certificate authority. DNS resolution points to the IP address 64.29.17.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. HTTP requests return status code 451, and the only visible page title is “Deployment Unavailable”, consistent with a deliberately taken‑offline deployment.

VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The domain appears on five independent blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, each categorising it as a crypto‑related scam. The listed scam type is “Crypto Scam”, aligning with the broader classification of a crypto drainer. Observable evidence confirms that the infrastructure is typical of rapidly provisioned scam sites: a recent registration, cloud hosting on a major provider, and a valid SSL certificate that may be used to lend credibility. The current offline status prevents direct content analysis, so the exact payload or lure employed remains unknown.

Investigators have not recovered any landing page or malicious script, and the “Deployment Unavailable” title suggests the operator has withdrawn the site, possibly after achieving its objective. Defenders should continue to block the domain at network perimeter and DNS layers, and add the associated IP address 64.29.17.131 to host‑based deny lists. Monitoring of the registrar (Tucows) for new domains with similar naming patterns is advisable, as the attacker may reuse the same registration service.