nft-giftbox15-kohl[.]vercel[.]app

This domain, nft-giftbox15-kohl.vercel.app, was created on 21 February 2026 and is currently listed as offline with an HTTP 451 status and the page title “Deployment Unavailable”. The site is hosted on Vercel infrastructure; TLS is provided by Google Trust Services under the WR1 certificate and HSTS is enforced. DNS resolves to IP 216.198.79.67, an address owned by Amazon.com, Inc. (AS16509) located in the United States. Registration was performed through Tucows Domains Inc. Security telemetry indicates that the domain appears on a single security blocklist and is specifically blocked by PhishDestroy.

VirusTotal analysis shows that 14 of 93 scanning engines flagged the domain, reinforcing the suspicion that it is being used for malicious activity. The threat classification supplied is “NFT Scam”, which aligns with the broader category of crypto drainer campaigns that target users with fraudulent NFT offers. The available evidence confirms that the domain’s infrastructure is typical of a short‑lived malicious deployment: recent registration, rapid provisioning on a cloud‑based hosting platform, and a deliberately unavailable front‑end page designed to hide payloads. However, the exact payload or phishing kit has not been observed, and no concrete page content beyond the generic “Deployment Unavailable” title is available for analysis.

Consequently, the precise mechanisms used to drain cryptocurrency remain uncertain. Defenders should continue to block the domain at perimeter filters and update any threat‑intelligence feeds with the observed indicators: domain name, IP address 216.198.79.67, ASN AS16509, creation date 2026‑02‑21, SSL issuer Google Trust Services, and the VirusTotal detection count. Monitoring of related Vercel sub‑domains and of newly registered domains using the same registrar may help identify follow‑up campaigns. Users should be warned that any unsolicited communications referencing NFT giveaways linked to this domain are likely fraudulent.